$ cve CVE-2006-2370 JSON

CVE-2006-2370 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 70.1% (pctl 99)

Patch early

A public exploit exists.

Description

Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corruption Vulnerability."

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	70.14% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-06-13
Last modified	2026-06-16

Affected (3)

Vendor	Product
microsoft	windows 2000
microsoft	windows 2003 server
microsoft	windows xp

Public exploits

Source	Title	Date
exploit-db	Microsoft RRAS Service - RASMAN Registry Overflow (MS06-025) (Metasploit)	2010-08-25
exploit-db	Microsoft RRAS Service - Remote Overflow (MS06-025) (Metasploit)	2010-05-09
exploit-db	Microsoft Windows - RRAS RASMAN Registry Stack Overflow (MS06-025) (Metasploit)	2006-06-29
exploit-db	Microsoft Windows RRAS - Remote Stack Overflow (MS06-025) (Metasploit)	2006-06-22

References

→ the Explorer · watch your stack · NVD