4.3
CVSSv2

CVE-2012-2494

Published: 20/06/2012 Updated: 21/06/2012
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Summary

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x prior to 2.5 MR6 and 3.x prior to 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote malicious users to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtw48681.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.
Vulnerable Product Search on Vulmon Subscribe to Product

cisco anyconnect secure mobility client 2.1

cisco anyconnect secure mobility client 2.3.185

cisco anyconnect secure mobility client 2.3.254

cisco anyconnect secure mobility client 2.4.0202

cisco anyconnect secure mobility client 2.4.1012

cisco anyconnect secure mobility client 2.5

cisco anyconnect secure mobility client 3.0

cisco anyconnect secure mobility client 2.2.128

cisco anyconnect secure mobility client 2.2.133

cisco anyconnect secure mobility client 2.2.136

cisco anyconnect secure mobility client 2.2.140

cisco anyconnect secure mobility client 2.3

cisco anyconnect secure mobility client 2.0

cisco anyconnect secure mobility client 2.2

cisco anyconnect secure mobility client 2.3.2016

cisco anyconnect secure mobility client 2.4

Vendor Advisories

The Cisco AnyConnect Secure Mobility Client is affected by the following vulnerabilities: Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerability Cisco AnyConnect Secure Mobility Client VPN Downloader Software Downgrade Vulnerability Cisco AnyConnect Secure Mobility Client and Cisco Secure Deskto ...