CVE-2006-3561
BT Voyager 2091 Wireless firmware 2.21.05.08m_A2pB018c1.d16d and earlier, and 3.01m and earlier,...
BT Voyager 2091 Wireless firmware 2.21.05.08m_A2pB018c1.d16d and earlier, and 3.01m and earlier, allow remote attackers to bypass the authentication process and gain sensitive information, such as configuration information via (1) /btvoyager_getconfig.sh, PPP credentials via (2) btvoyager_getpppcreds.sh, and decode configuration credentials via (3) btvoyager_decoder.c.
Exploit likelihood
What each source reports
NVD Score used
5.0
BT Voyager 2091 Wireless firmware 2.21.05.08m_A2pB018c1.d16d and earlier, and 3.01m and earlier, allow remote attackers to bypass the authentication process and gain sensitive information, such as configuration information via (1) /btvoyager_getconfig.sh, PPP credentials via (2) btvoyager_getpppcreds.sh, and decode configuration credentials via (3) btvoyager_decoder.c.
- Record
CVE-2006-3561- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200, CWE-264
- Updated
- 2026-11-02
CVE List No score
BT Voyager 2091 Wireless firmware 2.21.05.08m_A2pB018c1.d16d and earlier, and 3.01m and earlier, allow remote attackers to bypass the authentication process and gain sensitive information, such as configuration information via (1) /btvoyager_getconfig.sh, PPP credentials via (2) btvoyager_getpppcreds.sh, and decode configuration credentials via (3) btvoyager_decoder.c.
- Record
CVE-2006-3561- Updated
- 2026-11-02
EUVDEUVD-2006-3556 No score
BT Voyager 2091 Wireless firmware 2.21.05.08m_A2pB018c1.d16d and earlier, and 3.01m and earlier, allow remote attackers to bypass the authentication process and gain sensitive information, such as configuration information via (1) /btvoyager_getconfig.sh, PPP credentials via (2) btvoyager_getpppcreds.sh, and decode configuration credentials via (3) btvoyager_decoder.c.
- Record
EUVD-2006-3556- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5gpw-gj4x-9w63 No score
BT Voyager 2091 Wireless firmware 2.21.05.08m_A2pB018c1.d16d and earlier, and 3.01m and earlier,...
BT Voyager 2091 Wireless firmware 2.21.05.08m_A2pB018c1.d16d and earlier, and 3.01m and earlier, allow remote attackers to bypass the authentication process and gain sensitive information, such as configuration information via (1) /btvoyager_getconfig.sh, PPP credentials via (2) btvoyager_getpppcreds.sh, and decode configuration credentials via (3) btvoyager_decoder.c.
- Record
GHSA-5gpw-gj4x-9w63- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | BT Voyager 2091 (Wireless ADSL) - Multiple Vulnerabilities | 2006-07-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3561 is a medium vulnerability (CVSS 5.0) in Bt Voyager 2091 Wireless Adsl Router, published July 13, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.72%, the 93rd percentile. No source names a fixed version.
References
securityfocus.com/archive/1/489009/100/0/threaded
gnucitizen.org/projects/router-hacking-challenge
gnucitizen.org/blog/holes-in-embedded-devices-authentication-bypass-pt-3
securityfocus.com/bid/19057
securityfocus.com/archive/1/440405/100/0/threaded
lists.grok.org.uk/pipermail/full-disclosure/2006-July/047733.html