CVE-2006-2707: Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 does not validate the peer certificate when obtai

Routine

MEDIUM 5.0DOWNGRADE

CVE-2006-2707 is a medium-severity flaw (CVSS 5.0) affecting class 5 enterprise vulnerability management. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 does not validate the peer certificate when obtaining an update, which could allow remote attackers to distribute malicious updates to clients.

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.0 (Medium)
EPSS exploit chance	1.1% (top 33%)
CISA exploited list	No
Published	2006-05-31
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: secure elements

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2006-05-31 22:02 UTCPublished CVE record published
2026-06-16 22:25 UTCUpdated Record last modified

secure elements class 5 enterprise vulnerability management DOWNGRADE

Affected: 2.8.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.8.0

1. Check installed version

apt-cache policy class-5-enterprise-vulnerability-management || rpm -q class-5-enterprise-vulnerability-management || class-5-enterprise-vulnerability-management --version

2. No fixed release: DOWNGRADE to a release before 2.8.0 (Debian / Ubuntu)

apt-cache madison class-5-enterprise-vulnerability-management sudo apt install class-5-enterprise-vulnerability-management=<VERSION_BEFORE_2.8.0> sudo apt-mark hold class-5-enterprise-vulnerability-management

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list class-5-enterprise-vulnerability-management sudo dnf downgrade class-5-enterprise-vulnerability-management-<VERSION_BEFORE_2.8.0> sudo dnf versionlock add class-5-enterprise-vulnerability-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2006-2707?

class 5 enterprise vulnerability management: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2006-2707 being exploited?

CVE-2006-2707 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2006-2707 affect?

CVE-2006-2707 affects class 5 enterprise vulnerability management. Severity is medium (CVSS 5.0). Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 does not validate the peer certificate when obtaining an update, which could allow remote attackers to distribute malicious updates to clients.

How urgent is CVE-2006-2707?

Priority 34/100. No elevated risk signals yet.

Related CVEs

CVE-2006-2712 MEDIUM 5.0 DOWNGRADE Secure Elements Class 5 AVR (aka C5 EVM) client and server before 2.8.1 do not verify the integrity of a messa
CVE-2006-2711 MEDIUM 5.0 DOWNGRADE Secure Elements Class 5 AVR (aka C5 EVM) 2.8.1 and earlier, and possibly later 2.8.x releases, uses the same i
CVE-2006-2710 MEDIUM 5.0 DOWNGRADE Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 uses the same invariant RSA key for all installations, w
CVE-2006-2709 MEDIUM 5.0 DOWNGRADE Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 do not validate the source address of a message, which a
CVE-2006-2708 MEDIUM 5.0 DOWNGRADE Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 allows remote attackers to read portions of proce

References

← Back to latest CVEs