Vulnerability Details : CVE-2002-1106
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.
Products affected by CVE-2002-1106
- cpe:2.3:a:cisco:vpn_client:3.5.1:*:windows:*:*:*:*:*
- cpe:2.3:a:cisco:vpn_client:2.0:*:windows:*:*:*:*:*
- cpe:2.3:a:cisco:vpn_client:3.0:*:windows:*:*:*:*:*
- cpe:2.3:a:cisco:vpn_client:3.1:*:windows:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2002-1106
0.39%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 57 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2002-1106
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2002-1106
-
http://www.securityfocus.com/bid/5652
Vendor Advisory
-
http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml
AI Infrastructure, Secure Networking, and Software Solutions - CiscoVendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/10045
Jump to