| Package | Affected versions | Patched versions |
|---|---|---|
| anyconnect secure mobility client | = 2.0= 2.1= 2.2= 2.2.128= 2.2.133= 2.2.136= 2.2.140= 2.3= 2.3.185= 2.3.2016= 2.3.254= 2.4= 2.4.0202= 2.4.1012= 2.5= 2.5.1025= 2.5.2001= 2.5.2006= 2.5.2010= 2.5.2011= 2.5.2014= 2.5.2017= 2.5.2018= 3.0≤ 2.5.2019 |
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629, on Linux and Mac OS X downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a Java applet, aka Bug ID CSCsy05934.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free