The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) prior to 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote malicious users to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
cisco anyconnect_secure_mobility_client 2.0 |
||
cisco anyconnect_secure_mobility_client 2.2.133 |
||
cisco anyconnect_secure_mobility_client 2.2.128 |
||
cisco anyconnect_secure_mobility_client 2.2.140 |
||
cisco anyconnect_secure_mobility_client 2.2.136 |
||
cisco anyconnect_secure_mobility_client 2.1 |
||
cisco anyconnect_secure_mobility_client 2.2 |
||
cisco anyconnect_secure_mobility_client |