CVE-2010-4148

CRITICAL 9.3CVE-2010-4148 · Published 02/11/2010 · updated 16/06/2026

In short

CVE-2010-4148 is a CRITICAL (CVSS 9.3) vulnerability affecting anyconnect (anyconnect).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
anyconnect anyconnect	`≤ 1.2.3.0`	No fix yet

Description

Directory traversal vulnerability in AnyConnect 1.2.3.0, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.

References

marc.info · Exploit
packetstormsecurity.org/1010-exploits/anyconnect-traversal.txt · Exploit
secunia.com/advisories/41802 · Vendor Advisory
htbridge.ch/advisory/directory_traversal_vulnerability_in_anyconnect.html · Exploit
osvdb.org/68666
securityfocus.com/bid/44076
exchange.xforce.ibmcloud.com/vulnerabilities/62563

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free