Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-7600

Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section.

Published

2015-10-06T17:59:27.057

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.2 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco vpn_client 5.0 Yes
Application cisco vpn_client 5.0.01 Yes
Application cisco vpn_client 5.0.01.0600 Yes
Application cisco vpn_client 5.0.2 Yes
Application cisco vpn_client 5.0.02.0090 Yes
Application cisco vpn_client 5.0.2.0090 Yes
Application cisco vpn_client 5.0.03.0530 Yes
Application cisco vpn_client 5.0.03.0560 Yes
Application cisco vpn_client 5.0.04.0300 Yes
Application cisco vpn_client 5.0.5 Yes
Application cisco vpn_client 5.0.05.0290 Yes
Application cisco vpn_client 5.0.6 Yes
Application cisco vpn_client 5.0.06.0160 Yes
Application cisco vpn_client 5.0.7 Yes
Application cisco vpn_client 5.0.7.0240 Yes
Application cisco vpn_client 5.0.7.0290 Yes
Application cisco vpn_client 5.0.07.0290 Yes
Application cisco vpn_client 5.0.07.0410 Yes
Application cisco vpn_client 5.0.07.0440 Yes
Application cisco vpn_client 5.0.7.0440 Yes
References