Cisco AnyConnect Secure Mobility Client provides remote mobile users with secure IPsec (IKEv2) or SSL Virtual Private Network (VPN) connections to Cisco 5500 Series Adaptive Security Appliances (ASA) and devices that are running Cisco IOS Software.
The AnyConnect Secure Mobility Client web deployment package uses an ActiveX control (
**vpnweb.ocx**) to download and start the downloader application for the Secure Mobility Client application. A remote code execution vulnerability exists in the
**vpnweb.ocx** ActiveX control because it fails to properly validate the authenticity of the downloaded executable when the client is deployed from the VPN headend. A remote attacker can exploit this vulnerability by enticing a user to open a specially crafted web page.
Cisco has released free software updates that address these vulnerabilities.
Exploit works on Cisco Systems AnyConnect Secure Mobility Client For Windows 2.3.0254.
The HTML page of the exploit must be opened using Internet Explorer 7 or 8 on the target.