9.3

CVE-2012-2493

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug ID CSCtw47523.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.128
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.133
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.136
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version2.2.140
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version2.3.185
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version2.3.254
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version2.3.2016
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version2.4.0202
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version2.4.1012
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.58% 0.798
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.