CVE-2012-2493: cisco anyconnect_secure_mobility_client Improper Input Validation

Vulnerability summary

CVE-2012-2493 is a high (CVSS 9.3) Improper Input Validation vulnerability in cisco anyconnect_secure_mobility_client. EPSS estimates a 3.89% chance of exploitation in the next 30 days, higher than 90.1% of scored vulnerabilities.

Timeline

1. 20-06-2012
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug ID CSCtw47523.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.