CVE-2012-2498: Medium severity cisco anyconnect secure vulnerability
Cisco AnyConnect Secure Mobility Client 3.0 through 3.0.08066 does not ensure that authentication makes use of a legitimate certificate, which allows user-assisted man-in-the-middle attackers to spoof servers via a crafted certificate, aka Bug ID CSCtz29197.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2498?
CVE-2012-2498 is classified as a medium-severity vulnerability that may allow man-in-the-middle attacks.
How do I fix CVE-2012-2498?
To mitigate CVE-2012-2498, users should upgrade the Cisco AnyConnect Secure Mobility Client to a version that addresses the issue.
What versions of the Cisco AnyConnect Secure Mobility Client are affected by CVE-2012-2498?
CVE-2012-2498 affects Cisco AnyConnect Secure Mobility Client versions 3.0 through 3.0.08066.
Can CVE-2012-2498 be exploited without user interaction?
Exploitation of CVE-2012-2498 requires user assistance, as it involves spoofing through a crafted certificate.
What type of attack does CVE-2012-2498 facilitate?
CVE-2012-2498 allows attackers to perform man-in-the-middle attacks by spoofing servers.