A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility…

Published 8 y ago 2018-06-07 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.0%

percentile 62%

Public exploits

none known

A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading certain configuration files. The vulnerability is due to improper use of Simple Certificate Enrollment Protocol and improper server certificate validation. An attacker could exploit this vulnerability by preparing malicious profile and localization files for Cisco AnyConnect to use. A successful exploit could allow the attacker to remotely change the configuration profile, a certificate, or the localization data used by AnyConnect Secure Mobility Client. Cisco Bug IDs: CSCvh23141.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 23 mo ago 2024-11-29

Exploit prediction (EPSS)

0.96% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	4.8	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N`
NVD	2.0	5.8	`AV:N/AC:M/Au:N/C:P/I:P/A:N`

Affected products

n/a Cisco AnyConnect Secure Mobility Client unknown

Classification

Weakness

CWE-295 Improper Certificate Validation

References

securityfocus.com /bid/104430 · vdb-entry, x_refsource_BID, x_transferred
tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-AnyConnect-cert-bypass · x_refsource_CONFIRM, x_transferred
securitytracker.com /id/1041075 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

CVE List: CVE-2018-0334
NVD: CVE-2018-0334

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary