CVE-2011-2040
highpriority · track · 41EPSS 0.107 · 96 %ileEUUSEPSS · scored 2026-10-28
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629, on Linux and Mac OS X downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a Java applet, aka Bug ID CSCsy05934.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (26)
Products and version ranges known to be affected.
- cisco anyconnect secure mobility client≤ 2.5.2019nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.0nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.1nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.2nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.2.128nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.2.133nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.2.136nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.2.140nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.3nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.3.185nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.3.2016nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.3.254nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.4nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.4.0202nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.4.1012nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.5nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.5.1025nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.5.2001nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
- cisco anyconnect secure mobility client= 2.5.2006nvdUScpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtmlcnnvd
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=910enisa_euvd
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtmlenisa_euvd
- http://www.kb.cert.org/vuls/id/490097enisa_euvd
- http://www.securitytracker.com/id?1025591enisa_euvd
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67739enisa_euvd
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=910nvd
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtmlVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan