CVE-2006-3325

CVE-2006-3325 describes a vulnerability in the id3 Quake 3 Engine 1.32c and Icculus Quake 3 Engine (ioquake3) revision 810 and earlier, allowing remote malicious servers to overwrite arbitrary write-protected client variables (cvars) like cl_allowdownload and fs_homepath. This vulnerability has a CVSS score of 5.0, indicating a medium severity with a network attack vector, low complexity, and potential for partial integrity impact without requiring authentication. While there is no evidence of active exploitation, Metasploit or Nuclei modules, or significant community discussion, it's noted that this cvar overwrite could be combined with another vulnerability to overwrite arbitrary files.