CVE-2007-2586

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 11.3 through 12.4

Description The issue allows remote attackers to execute arbitrary code and have other impacts, including reading the startup-config. This can be achieved by sending a crafted MKD command that involves access to a VTY device and overflows a buffer. The vulnerability can also result in a denial of service condition, improper verification of user credentials, and the ability to retrieve or write any file from the device filesystem, including the device's saved configuration, which may include passwords or other sensitive information.

Recommendations For Cisco IOS versions 11.3 through 12.4, consider disabling the FTP Server feature as a temporary workaround until a patch is available. Restrict access to the VTY device to minimize the risk of exploitation. Avoid using the MKD command in the FTP Server until the issue is resolved.