CVE-2011-2040

2011-06-0219:55:00

CWE-20

[email protected]

web.nvd.nist.gov

cisco

anyconnect

secure

mobility

client

remote code execution

java

applet

cve-2011-2040

7.7 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.058 Low

EPSS

Percentile

93.4%

JSON

The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629, on Linux and Mac OS X downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a Java applet, aka Bug ID CSCsy05934.

CPENameOperatorVersion
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clientle2.5.2019
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.0
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.1
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.2
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.2.128
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.2.133
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.2.136
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.2.140
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.3
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.3.185

CPE	Name	Operator	Version
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	le	2.5.2019
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.0
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.1
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.2
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.2.128
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.2.133
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.2.136
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.2.140
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.3
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.3.185