CVE-2005-4499

CVE-2005-4499 affects Cisco PIX and VPN 3000 concentrators via the Downloadable RADIUS ACLs feature. When an ACL is created on CS ACS, the system generates a random internal name that doubles as a hidden username and password, enabling a remote attacker to sniff the cleartext username from a RADI...

CVE-2002-1102

CVE-2002-1102 affects Cisco VPN 3000 Concentrator LAN-to-LAN IPSEC capability (versions 2.2.x and 3.x before 3.5.4). A remote attacker can trigger a denial of service by initiating a LAN-to-LAN connection that conflicts with an existing security association, causing the concentrator to terminate ...

CVE-2005-0943

CVE-2005-0943 affects Cisco VPN 3000 Series Concentrator running firmware 4.1.7.A and earlier. The vulnerability allows remote attackers to cause a denial of service (device reload or user connection drop) by sending a crafted HTTPS packet. Attack vector is network, with low complexity and no aut...

CVE-2003-0259

The CVE-2003-0259 issue affects Cisco VPN 3000 Series Concentrators and the Cisco VPN 3002 Hardware Client (2.x–3.6.7). A malformed SSH initialization packet during the initial SSH session setup could cause the device to reload, yielding a denial-of-service condition. CERT/CC and Cisco advisories...

CVE-2002-1100

CVE-2002-1100 affects Cisco VPN 3000 Concentrator versions 2.2.x and 3.x prior to 3.5.3. The vulnerability allows remote attackers to trigger a denial of service (crash) by sending an excessively long username or password to the HTML login interface. The issue is evidenced by the NVD description ...

CVE-2002-1094

Cisco VPN 3000 Series Concentrator Information Disclosure (CVE-2002-1094) affects 2.x.x and 3.x.x firmware up to but not including 3.5.4. The vulnerability leaks potentially sensitive information via banners in SSH, FTP, or an incorrect HTTP request, allowing remote information disclosure without...

CVE-2002-1095

The vulnerability CVE-2002-1095 affects Cisco VPN 3000 Concentrator firmware prior to 2.5.2(F). When encryption is enabled, a remote attacker using a Windows PPTP client with the No Encryption option can trigger a denial of service (reload). The description does not provide additional root-cause ...

CVE-2002-1097

Cisco VPN 3000 Concentrator is affected (versions 2.2.x and 3.x before 3.5.2). The issue is that certificate passwords are stored in plaintext in the HTML source of Certificate Management pages, allowing restricted administrators to access them. The documented fix is upgrading to 3.5.2 or later. ...

CVE-2002-1103

The CVE-2002-1103 issue affects Cisco VPN 3000 Concentrator devices running 2.2.x, 3.6(Rel), and 3.x before 3.5.5. The root cause is handling ISAKMP packets; malformed or an excessive number of ISAKMP packets can cause the device to reload, resulting in a denial of service. Attacks can be perform...

CVE-2003-0258

CVE-2003-0258 affects Cisco VPN 3000 Series Concentrators and Cisco VPN 3002 Hardware Client (3.5.x–4.0.REL). When IPSec over TCP is enabled for a port on the concentrator, traffic forwarded on that port may be delivered to all hosts on the protected network, not only those using IPsec, enabling ...

CVE-2002-1096

CVE-2002-1096 affects Cisco VPN 3000 Concentrator (2.2.x and 3.x before 3.5.1). The root cause is that user passwords are stored in plaintext inside HTML source code of the embedded web server, allowing restricted administrators to obtain passwords. Documents confirm the vulnerability and impacte...

CVE-2002-1098

CVE-2002-1098 affects Cisco VPN 3000 Concentrator 2.2.x and 3.x prior to 3.5.3. When the XML filter configuration is enabled, the device’s HTTPS on Public Inbound (XML-Auto)(forward/in) rule sets the protocol to ANY, allowing arbitrary traffic to pass through the concentrator. The available docum...

CVE-2002-1101

Cisco VPN 3000 Concentrator versions 2.2.x, 3.6(Rel), and 3.x before 3.5.5 are affected by CVE-2002-1101. The vulnerability allows remote attackers to cause a denial of service by sending a long username, indicating an input handling flaw that can exhaust resources and affect availability. No exp...

CVE-2002-1099

Cisco VPN 3000 Concentrator versions 2.2.x and 3.x prior to 3.5.3 are vulnerable to an information disclosure allowing remote attackers to access certain HTML pages without authentication. The issue compromises confidentiality (partial) and is exploitable over the network with low complexity and ...

CVE-2003-0260

Cisco VPN 3000 Series Concentrators and Cisco VPN 3002 Hardware Client (2.x.x–3.6.7A) are affected by a DoS vulnerability caused by a flood of malformed ICMP packets, potentially degrading performance or causing a reload. The issue is triggered remotely and is documented across NVD and CERT advis...