critical
9.3
CWE
20
Advisory Published
Updated

CVE-2011-2040: Input Validation

First published: Thu Jun 02 2011(Updated: )

The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629, on Linux and Mac OS X downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a Java applet, aka Bug ID CSCsy05934.

Credit: ykramarz@cisco.com

Affected SoftwareAffected VersionHow to fix
Cisco AnyConnect Secure<=2.5.2019
Cisco AnyConnect Secure=2.0
Cisco AnyConnect Secure=2.1
Cisco AnyConnect Secure=2.2
Cisco AnyConnect Secure=2.2.128
Cisco AnyConnect Secure=2.2.133
Cisco AnyConnect Secure=2.2.136
Cisco AnyConnect Secure=2.2.140
Cisco AnyConnect Secure=2.3
Cisco AnyConnect Secure=2.3.185
Cisco AnyConnect Secure=2.3.254
Cisco AnyConnect Secure=2.3.2016
Cisco AnyConnect Secure=2.4
Cisco AnyConnect Secure=2.4.0202
Cisco AnyConnect Secure=2.4.1012
Cisco AnyConnect Secure=2.5
Cisco AnyConnect Secure=2.5.1025
Cisco AnyConnect Secure=2.5.2001
Cisco AnyConnect Secure=2.5.2006
Cisco AnyConnect Secure=2.5.2010
Cisco AnyConnect Secure=2.5.2011
Cisco AnyConnect Secure=2.5.2014
Cisco AnyConnect Secure=2.5.2017
Cisco AnyConnect Secure=2.5.2018
Cisco AnyConnect Secure=3.0
Apple iOS and macOS
Linux Kernel

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2011-2040?

    CVE-2011-2040 has a medium severity rating due to the lack of authenticity verification when downloading client executables.

  • How do I fix CVE-2011-2040?

    To fix CVE-2011-2040, upgrade to Cisco AnyConnect Secure Mobility Client version 2.5.3041 or later, or 3.0.629 or later.

  • What systems are affected by CVE-2011-2040?

    CVE-2011-2040 affects versions of Cisco AnyConnect Secure Mobility Client prior to 2.5.3041 and 3.0.x before 3.0.629 on Linux and Mac OS X.

  • Can CVE-2011-2040 allow remote code execution?

    Yes, CVE-2011-2040 can allow remote attackers to execute arbitrary code on affected systems.

  • Is there a workaround for CVE-2011-2040?

    There is no documented workaround for CVE-2011-2040, and the recommended action is to update to a patched version.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203