Description
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute
exploit/windows/browser/cisco_anyconnect_exec
Exploit-DB 1
- Cisco AnyConnect VPN Client - ActiveX URL Property Download and Execute (Metasploit) EDB-17366 · remote · Jun 6, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 72714 vdb-entry
- 20110601 Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client vendor-advisory
- 8272 third-party-advisory
- 1025591 vdb-entry
- VU#490097 third-party-advisory
- 20110601 Cisco AnyConnect VPN Client Arbitrary Program Execution Vulnerability third-party-advisory
- cisco-asmc-helper-code-execution(67739) vdb-entry