CVE-2012-2496
published 2012-06-20CVE-2012-2496: A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit…
PriorityP335medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
2.04%
78.8th percentile
A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit Linux platforms does not properly restrict use of Java components, which allows remote attackers to execute arbitrary code via a crafted web site, aka Bug ID CSCty45925.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | anyconnect_secure_mobility | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_cisco9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability
vendor_cisco·2012-06-20·CVSS 6.8
CVE-2012-2496 [MEDIUM] CWE-94 Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability
Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability
Cisco AnyConnect Secure Mobility Client contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system.
The vulnerability is due to insufficient validation of user-supplied input that is received by the 64-bit Java applet that performs the WebLaunch VPN downloader functionality in the affected software. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious website. If successful, the attacker could have the ability to execute arbitrary code with the privileges of the user on the affected system.
Cisco has confirmed this vulnerability in a security advisory and software updates are available.
Cisco
Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
vendor_cisco·2012-06-20·CVSS 9.3
CVE-2012-2493 [CRITICAL] CWE-399 Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
The Cisco AnyConnect Secure Mobility Client is affected by the following vulnerabilities:
Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerability
Cisco AnyConnect Secure Mobility Client VPN Downloader Software Downgrade Vulnerability
Cisco AnyConnect Secure Mobility Client and Cisco Secure Desktop Hostscan Downloader Software Downgrade Vulnerability
Cisco AnyConnect Secure Mobility Client 64-bit Java VPN Downloader Arbitrary Code Execution Vulnerability
Cisco Secure Desktop Arbitrary Code Execution Vulnerability
Cisco has released software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available. This advisory is available at the foll
Cisco
Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
vendor_cisco
CVE-2012-2496 Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
CVE-2012-2496: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
The Cisco AnyConnect Secure Mobility Client is affected by the following vulnerabilities: Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerability Cisco AnyConnect Secure Mobility Client VPN Downloader Software Downgrade Vulnerability Cisco AnyConnect Secure Mobility Client and Cisco Secure Desktop Hostscan Downloader Software Downgrade Vulnerability Cisco AnyConnect Secure Mobility Client 64-bit Java VPN Downloader Arbitrary Code Execution Vulnerability Cisco Secure Desktop Arbitrary Code Execution Vulnerability Cisco has released software updates that address these vulnerabilities.
CWE: CWE-399, CWE-399
Bug IDs: CSCtw47523, CSCtw48681, CSCtx74235, CSCtw47523, CSCtw48681
GHSA
GHSA-v4v3-hfpw-74cj: A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3
ghsa_unreviewed·2022-05-17
CVE-2012-2496 [MEDIUM] CWE-20 GHSA-v4v3-hfpw-74cj: A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3
A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit Linux platforms does not properly restrict use of Java components, which allows remote attackers to execute arbitrary code via a crafted web site, aka Bug ID CSCty45925.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2012-06-20
Published