7.6
CVE-2011-2039
- EPSS 84.12%
- Veröffentlicht 02.06.2011 19:55:04
- Zuletzt bearbeitet 11.04.2025 00:51:21
- Quelle psirt@cisco.com
- Teams Watchlist Login
- Unerledigt Login
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Anyconnect Secure Mobility Client Version <= 2.3
Cisco ≫ Anyconnect Secure Mobility Client Version2.0
Cisco ≫ Anyconnect Secure Mobility Client Version2.1
Cisco ≫ Anyconnect Secure Mobility Client Version2.2
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.128
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.133
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.136
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.140
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
Typ | Quelle | Score | Percentile |
---|---|---|---|
EPSS | FIRST.org | 84.12% | 0.993 |
Quelle | Base Score | Exploit Score | Impact Score | Vector String |
---|---|---|---|---|
nvd@nist.gov | 7.6 | 4.9 | 10 |
AV:N/AC:H/Au:N/C:C/I:C/A:C
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.