7.6

CVE-2011-2039

The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 69.96% 0.993
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.6 4.9 10
AV:N/AC:H/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=909
http://osvdb.org/72714
http://securityreason.com/securityalert/8272
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtml
Vendor Advisory
http://www.kb.cert.org/vuls/id/490097
US Government Resource
http://www.securitytracker.com/id?1025591
https://exchange.xforce.ibmcloud.com/vulnerabilities/67739