Vulnerability Details : CVE-2011-2039
Public exploit exists!
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.
Vulnerability category: Input validationExecute code
Products affected by CVE-2011-2039
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*When used together with: Microsoft » Windows Mobile
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.0:*:*:*:*:*:*:*When used together with: Microsoft » Windows Mobile
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.2.133:*:*:*:*:*:*:*When used together with: Microsoft » Windows Mobile
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.2.128:*:*:*:*:*:*:*When used together with: Microsoft » Windows Mobile
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.2.140:*:*:*:*:*:*:*When used together with: Microsoft » Windows Mobile
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.2.136:*:*:*:*:*:*:*When used together with: Microsoft » Windows Mobile
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.1:*:*:*:*:*:*:*When used together with: Microsoft » Windows Mobile
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.2:*:*:*:*:*:*:*When used together with: Microsoft » Windows Mobile
Exploit prediction scoring system (EPSS) score for CVE-2011-2039
80.38%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2011-2039
-
Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute
Disclosure Date: 2011-06-01First seen: 2020-04-26exploit/windows/browser/cisco_anyconnect_execThis module exploits a vulnerability in the Cisco AnyConnect VPN client vpnweb.ocx ActiveX control. This control is typically used to install the VPN client. An attacker can set the 'url' property which is where the control tries to locate the files needed to insta
CVSS scores for CVE-2011-2039
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.6
|
HIGH | AV:N/AC:H/Au:N/C:C/I:C/A:C |
4.9
|
10.0
|
NIST |
CWE ids for CVE-2011-2039
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-2039
-
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtml
Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client - CiscoVendor Advisory
-
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=909
-
http://www.securitytracker.com/id?1025591
Cisco AnyConnect Secure Mobility Client Lets Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges - SecurityTracker
-
http://securityreason.com/securityalert/8272
Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute - CXSecurity.com
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/67739
Cisco AnyConnect Secure Mobility Client helper application code execution CVE-2011-2040 Vulnerability Report
-
http://www.kb.cert.org/vuls/id/490097
VU#490097 - Cisco AnyConnect SSL VPN arbitrary code executionUS Government Resource
Jump to