CVE-2012-2498

Published: Aug 6, 2012Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Exploitability: 4.9 / Impact: 4.9

Source: NVD

Description

Cisco AnyConnect Secure Mobility Client 3.0 through 3.0.08066 does not ensure that authentication makes use of a legitimate certificate, which allows user-assisted man-in-the-middle attackers to spoof servers via a crafted certificate, aka Bug ID CSCtz29197.

Affected (5)

Products: Cisco: Anyconnect Secure Mobility Client

Cisco

1 product

Anyconnect Secure Mobility Client

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Cisco Anyconnect Secure Mobility Client	Version 3.0.0629
Cisco Anyconnect Secure Mobility Client	Version 3.0.07059
Cisco Anyconnect Secure Mobility Client	Version 3.0.08057
Cisco Anyconnect Secure Mobility Client	Version 3.0.08066
Cisco Anyconnect Secure Mobility Client	Version 3.0

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/release/notes/anyconnect30rn.html

Source: psirt@cisco.com

Vendor Advisory

http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/release/notes/anyconnect30rn.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.