Improper input validation in Cisco Anyconnect Secure Mobility Client

CVE-2013-1172

The Cisco Security Service in Cisco AnyConnect Secure Mobility Client (aka AnyConnect VPN Client) does not properly verify files, which allows local users to gain privileges via unspecified vectors, aka Bug ID CSCud14153.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.003 (25.0th percentile) — read the EPSS interpretation.

Affected products

Cisco Anyconnect_secure_mobility_client — versions 2.0, 2.1, 2.2
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)