Read the docs
TI-2005-03580 Aliases CVE-2005-3786GHSA-cvfx-7rq4-r2px

Novell ZENworks for Desktops 4.0.1, ZENworks for Servers 3.0.2, and ZENworks 6.5 Desktop…

Priority LOW 21Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Novell ZENworks for Desktops 4.0.1, ZENworks for Servers 3.0.2, and ZENworks 6.5 Desktop Management does not restrict access to Remote Diagnostics, which allows local users to bypass security policies by using Console One.

Why it matters now

EPSS 0.00339 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:novell:zenworks:6.5:*:*:*:*:*:*:*6.5VulnerableNovell
cpe:2.3:a:novell:zenworks_desktops:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableNovell
cpe:2.3:a:novell:zenworks_servers:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableNovell
  • cpe:2.3:a:novell:zenworks:6.5:*:*:*:*:*:*:* Versions 6.5 Vulnerable ·Novell
  • cpe:2.3:a:novell:zenworks_desktops:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Novell
  • cpe:2.3:a:novell:zenworks_servers:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Novell

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-3786
  2. 2026-10-03 Alias added: GHSA-cvfx-7rq4-r2px

References

Patch 1

Other 1

  • TI-2005-01454 Multiple stack-based and heap-based buffer overflows in Remote Management authentication… CVSS 2.0HIGH 7.5
  • TI-2006-03323 FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1… CVSS 2.0HIGH 7.5
  • TI-2006-03328 SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS)… CVSS 2.0HIGH 7.5
  • TI-2007-01086 Unspecified vulnerability in Novell ZENworks 7 Desktop Management Support Pack 1 before… CVSS 2.0MEDIUM 6.4
  • TI-2006-03324 Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences