CVEvulnerability

CVE-2011-2039

7.6 HIGH Published 2011-06-02 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2011-06-02
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.6 HIGH — AV:N/AC:H/Au:N/C:C/I:C/A:C
Weaknesses
CWE-20

Description

The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.

Affected configurations

• cisco anyconnect secure mobility client (<= 2.3) • cisco anyconnect secure mobility client 2.0 • cisco anyconnect secure mobility client 2.1 • cisco anyconnect secure mobility client 2.2 • cisco anyconnect secure mobility client 2.2.128 • cisco anyconnect secure mobility client 2.2.133 • cisco anyconnect secure mobility client 2.2.136 • cisco anyconnect secure mobility client 2.2.140

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References