Description
The VPN downloader in the download_install component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction, which allows remote attackers to obtain sensitive information via vectors involving an invalid certificate, aka Bug ID CSCua11967.
References (2)
Core 2
Core References
Release Notes x_refsource_confirm
http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/release/notes/anyconnect31rn.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/78916
Scores
EPSS
0.0101
EPSS Percentile
59.2%
Details
CWE
CWE-200
Status
published
Products (1)
cisco/anyconnect_secure_mobility_client
3.1.0
Published
Sep 16, 2012
Tracked Since
Feb 18, 2026