CVE-2006-6679: Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's...

Security readout for executives and security teams

CVE-2006-6679 is an access-control bypass in chetcpasswd before 2.4. The software trusted the client-controlled X-Forwarded-For HTTP header when checking whether a request came from an allowed IP address. An attacker could spoof that header to appear trusted and gain unauthorized access. Exposure is likely limited to systems still running chetcpasswd before 2.4, especially if reachable over HTTP and using IP-based ACLs. The bundle does not identify specific operating systems, packages, or CPEs. Treat as a legacy exposure cleanup item unless chetcpasswd is still internet-facing or used for sensitive account workflows. If present, prioritize removal or upgrade because the flaw bypasses an intended access boundary. Mitigation focus: Identify and retire any remaining chetcpasswd deployments before version 2.4.; Check vendor or package-maintainer guidance for the correct fixed version.; Restrict access to the service at the network or trusted reverse proxy layer..

Prepared

Jun 29, 2026, 08:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.