7.6
CVE-2011-2039
- EPSS 84.12%
- Published 02.06.2011 19:55:04
- Last modified 11.04.2025 00:51:21
- Source psirt@cisco.com
- Teams watchlist Login
- Open Login
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.
Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Anyconnect Secure Mobility Client Version <= 2.3
Cisco ≫ Anyconnect Secure Mobility Client Version2.0
Cisco ≫ Anyconnect Secure Mobility Client Version2.1
Cisco ≫ Anyconnect Secure Mobility Client Version2.2
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.128
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.133
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.136
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.140
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 84.12% | 0.993 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.6 | 4.9 | 10 |
AV:N/AC:H/Au:N/C:C/I:C/A:C
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.