CVE-2008-1246

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

The Cisco PIX/ASA Finesse Operation System 7.1 and 7.2 allows local users to gain privileges by entering characters at the enable prompt, erasing these characters via the Backspace key, and then holding down the Backspace key for one second after erasing the final character. NOTE: third parties, including one who works for the vendor, have been unable to reproduce the flaw unless the enable password is blank

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Mar 10, 2008
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2008

CVE-2008-124710.0The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote CVE-2008-12485.8The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "CallCVE-2008-12499.4snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service (application craCVE-2008-12509.3Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allowCVE-2008-12514.3Cross-site scripting (XSS) vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackersCVE-2008-125210.0b_banner.stm (aka the login page) on the Deutsche Telekom Speedport W500 DSL router allows remote attackers to obtain the logon password by CVE-2008-12534.3Cross-site scripting (XSS) vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attackers to inject arbitrary web scrCVE-2008-12546.8Multiple cross-site request forgery (CSRF) vulnerabilities on the ZyXEL P-660HW series router allow remote attackers to (1) change DNS serveCVE-2008-125510.0The ZyXEL P-660HW series router maintains authentication state by IP address, which allows remote attackers to bypass authentication by estaCVE-2008-125610.0The ZyXEL P-660HW series router has "admin" as its default password, which allows remote attackers to gain administrative access.CVE-2008-12574.3Cross-site scripting (XSS) vulnerability in Forms/DiagGeneral_2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitraCVE-2008-12584.3Cross-site scripting (XSS) vulnerability in prim.htm on the D-Link DI-604 router allows remote attackers to inject arbitrary web script or H
CVE-2008-1246: High severity, CVSS 7.8 | Vulnix