CVE-2006-2166
CVE-2006-2166 is a low-severity vulnerability in Cisco Unity Express Software with a CVSS 2.0 base score of 2.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Low (CVSS 2.0 base score 2.1)
- EPSS exploit prediction: 2% (73rd percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Cisco Unity Express Software
- Published:
- Last modified:
Description
Unspecified vulnerability in the HTTP management interface in Cisco Unity Express (CUE) 2.2(2) and earlier, when running on any CUE Advanced Integration Module (AIM) or Network Module (NM), allows remote authenticated attackers to reset the password for any user with an expired password.
Frequently asked questions
- What is CVE-2006-2166?
- Unspecified vulnerability in the HTTP management interface in Cisco Unity Express (CUE) 2.2(2) and earlier, when running on any CUE Advanced Integration Module (AIM) or Network Module (NM), allows remote authenticated attackers to reset the password for any user with an expired password.
- How severe is CVE-2006-2166?
- CVE-2006-2166 has a CVSS 2.0 base score of 2.1, rated low severity.
- Is CVE-2006-2166 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2006-2166?
- CVE-2006-2166 primarily affects Cisco Unity Express Software. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2006-2166?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2006-2166 published?
- CVE-2006-2166 was published on 2006-05-04 and last updated on 2026-06-16.
References
- http://secunia.com/advisories/19881
- http://securitytracker.com/id?1016015
- http://www.cisco.com/warp/public/707/cisco-sa-20060501-cue.shtml
- http://www.osvdb.org/25165
- http://www.securityfocus.com/bid/17775
- http://www.vupen.com/english/advisories/2006/1613
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26165
Affected products (4)
- cpe:2.3:a:cisco:unity_express_software:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:unity_express_software:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:unity_express_software:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:unity_express:*:*:*:*:*:*:*:*
More vulnerabilities in Cisco Unity Express Software
- CVE-2013-1120 — Medium (CVSS 6.8): Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow…
- CVE-2013-1114 — Medium (CVSS 4.3): Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unity Express before 8.0 allow remote attackers to inject…