CVE-2014-3314

Published: Jan 14, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Cisco AnyConnect on Android and OS X does not properly verify the host type, which allows remote attackers to spoof authentication forms and possibly capture credentials via unspecified vectors, aka Bug IDs CSCuo24931 and CSCuo24940.

Affected (2)

Products: Cisco: Anyconnect Secure Mobility Client

Cisco

1 product

Anyconnect Secure Mobility Client

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cisco Anyconnect Secure Mobility Client	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Cisco Anyconnect Secure Mobility Client	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3314

Source: psirt@cisco.com

Vendor Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3314

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.