Skip to main content

Anyconnect Secure Mobility Client CVE-2018-0334

MEDIUM
Improper Certificate Validation (CWE-295)
2018-06-07 psirt@cisco.com
Google Authentication Bypass Microsoft Cisco Anyconnect Secure Mobility Client
4.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 07, 2018 - 21:29 nvd
MEDIUM 4.8

DescriptionNVD

A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading certain configuration files. The vulnerability is due to improper use of Simple Certificate Enrollment Protocol and improper server certificate validation. An attacker could exploit this vulnerability by preparing malicious profile and localization files for Cisco AnyConnect to use. A successful exploit could allow the attacker to remotely change the configuration profile, a certificate, or the localization data used by AnyConnect Secure Mobility Client. Cisco Bug IDs: CSCvh23141.

AnalysisAI

A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-295. A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading certain configuration files. The vulnerability is due to improper use of Simple Certificate Enrollment Protocol and improper server certificate validation. An attacker could exploit this vulnerability by preparing malicious profile and localization files for Cisco AnyConnect to use. A successful exploit could allow the attacker to remotely change the configuration profile, a certificate, or the localization data used by AnyConnect Secure Mobility Client. Cisco Bug IDs: CSCvh23141. Affected products include: Cisco Anyconnect Secure Mobility Client.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Anyconnect Secure Mobility Client

View all
CVE-2020-3433 HIGH POC
7.8 Aug 17

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows c
CVE-2020-3153 MEDIUM POC
6.5 Feb 19

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authent
CVE-2017-3813 HIGH POC
7.8 Feb 09

A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows c
CVE-2015-6306 HIGH POC
7.2 Sep 26

Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions,

CVE-2015-6305 HIGH POC
7.2 Sep 26

Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConne
CVE-2012-2493 CRITICAL
9.3 Jun 20

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6
CVE-2012-3088 CRITICAL
9.3 Sep 16

Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check whether an HTTP request origin
CVE-2016-6369 HIGH
7.8 Aug 25

Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows l
CVE-2017-6638 HIGH
7.8 Jun 08

A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an auth
CVE-2023-20178 HIGH
7.8 Jun 28

A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco S
CVE-2021-40124 HIGH
7.8 Nov 04

A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could

CVE-2021-1496 HIGH
7.8 May 06

Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8
CVE-2024-3738 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2018-0334 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy