CVEvulnerability
CVE-2021-45035
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-09-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.3 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- CVSS 3.1 ([email protected])
- 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-287, CWE-295
Description
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
Affected configurations
• velneo vclient 28.1.3
Related
References
- https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados Vendor Advisory
- https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/ Vendor Advisory
- https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication Third Party Advisory
- https://www.velneo.com/blog/nueva-revision-velneo-29-2 Vendor Advisory
- https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados Vendor Advisory
- https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/ Vendor Advisory
- https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication Third Party Advisory
- https://www.velneo.com/blog/nueva-revision-velneo-29-2 Vendor Advisory