RCE in Cisco Secure Desktop

CVE-2015-0691

A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.031 (86.3th percentile) — read the EPSS interpretation.

Affected products

Cisco Secure_desktop — versions 3.0_base, 3.1.0.31, 3.1.1
N/a — versions n/a

Weakness classification (CWE)

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Mitigation, Vendor Advisory)
psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)