CVE-2012-2500 — Cisco Anyconnect Secure Mobility Client vulnerability

CWE-3104 documents4 sources
Severity
4.0MEDIUMNVD
EPSS
0.1%
top 66.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Anyconnect Secure Mobility Client
Timeline
PublishedAug 6
Latest updateMay 17

Description

Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 does not verify the certificate name in an X.509 certificate during WebLaunch of IPsec, which allows man-in-the-middle attackers to spoof servers via a crafted certificate, aka Bug ID CSCtz29470.

CVSS vector

AV:N/AC:H/C:P/I:P/A:NExploitability: 4.9 | Impact: 4.9

Affected Packages1 packages

▶NVDcisco/anyconnect_secure_mobility_client3.0, 3.0.0629, 3.0.07059+2

🔴Vulnerability Details

2
GHSA
GHSA-pcm4-7w5w-hxc6: Cisco AnyConnect Secure Mobility Client 3↗2022-05-17
▶
CVEList
CVE-2012-2500: Cisco AnyConnect Secure Mobility Client 3↗2012-08-06
▶

📋Vendor Advisories

1
Cisco
Cisco AnyConnect Secure Mobility Client WebLaunch Session Hijack Vulnerability↗2012-08-09
▶
CVE-2012-2500 — Cisco vulnerability | cvebase