CVE-2012-2500

2022-10-0316:15:35

CWE-310

[email protected]

web.nvd.nist.gov

cisco

anyconnect

secure mobility client

x.509 certificate

weblaunch

ipsec

cve-2012-2500

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

6.4 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.9%

JSON

Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 does not verify the certificate name in an X.509 certificate during WebLaunch of IPsec, which allows man-in-the-middle attackers to spoof servers via a crafted certificate, aka Bug ID CSCtz29470.

Affected configurations

NVD

Node

ciscoanyconnect_secure_mobility_clientMatch3.0

ciscoanyconnect_secure_mobility_clientMatch3.0.0629

ciscoanyconnect_secure_mobility_clientMatch3.0.07059

CPENameOperatorVersion
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq3.0
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq3.0.0629
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq3.0.07059

CPE	Name	Operator	Version
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	3.0
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	3.0.0629
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	3.0.07059