CVE-2006-3291

CVE-2006-3291 describes a critical vulnerability in the web interface of Cisco IOS 12.3(8)JA and 12.3(8)JA1, specifically affecting Cisco Wireless Access Points and Wireless Bridges. When the "Local User List Only (Individual Passwords)" setting is applied, the system reconfigures itself, inadvertently removing all existing security and password configurations. This flaw allows unauthenticated remote attackers to gain complete access to the affected devices. The vulnerability carries a CVSS score of 9.3, indicating critical severity due to its network-based attack vector, medium attack complexity, and complete compromise of confidentiality, integrity, and availability. Despite its age, the EPSS score is low, suggesting a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered minimal community attention, with no social media mentions or media coverage.