CVE-2018-0373: cisco anyconnect_secure_mobility_client Improper Input Validation
Vulnerability summary
CVE-2018-0373 is a medium (CVSS 5.5) Improper Input Validation vulnerability in cisco anyconnect_secure_mobility_client. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32% of scored vulnerabilities.
Timeline
- 21-06-2018PublishedVulnerability first disclosed.
- 29-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious request to the application. A successful exploit could allow the attacker to cause a DoS condition on the affected system. Cisco Bug IDs: CSCvj47654.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
0.00 pp
From 0.39% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco1 product
- anyconnect_secure_mobility_client4.5\(58\) | 4.5\(1044\) | 4.5\(2033\) | 4.5\(2036\) | 4.5\(3040\) | 4.5\(4029\) | 4.5\(5030\) | 4.6\(362\) | 4.6\(1098\)
1 vendor · 1 product
References
3 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-anyconnect-dosX Refsource CONFIRMVendor Advisory