Vulnerability in Cisco Vpn Client

CVE-2015-7600

Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section.

EPSS: 0.005 (42.1th percentile) — read the EPSS interpretation.

Affected products

Cisco Vpn_client — versions 5.0, 5.0.01, 5.0.01.0600
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)