Details of VAR-201710-0646

ID

VAR-201710-0646

CVE

CVE-2017-12268

TITLE

Cisco AnyConnect Secure Mobility Client Access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-009270

DESCRIPTION

A vulnerability in the Network Access Manager (NAM) of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters, aka a Dual-Homed Interface vulnerability. The vulnerability is due to insufficient NAM policy enforcement. An attacker could exploit this vulnerability by manipulating network interfaces of the device to allow multiple active network interfaces. A successful exploit could allow the attacker to send traffic over a non-authorized network interface. Cisco Bug IDs: CSCvf66539. Vendors have confirmed this vulnerability Bug ID CSCvf66539 It is released as.Information may be tampered with. An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. Network Access Manager (NAM) is one of the network access managers

Trust: 1.98

sources: NVD: CVE-2017-12268 // JVNDB: JVNDB-2017-009270 // BID: 101157 // VULHUB: VHN-102773

AFFECTED PRODUCTS

vendor:	cisco	model:	anyconnect secure mobility client	scope:	eq	version:	4.5\(822\)	Trust: 1.6
vendor:	cisco	model:	anyconnect secure mobility client	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	anyconnect secure mobility client	scope:	eq	version:	4.5(822)	Trust: 0.3

sources: BID: 101157 // JVNDB: JVNDB-2017-009270 // CNNVD: CNNVD-201710-050 // NVD: CVE-2017-12268

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-12268
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-12268
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201710-050
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-102773
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2017-12268
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:N/I:P/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-102773
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:N/I:P/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-12268
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.0
impactScore:	4.0
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-102773 // JVNDB: JVNDB-2017-009270 // CNNVD: CNNVD-201710-050 // NVD: CVE-2017-12268

PROBLEMTYPE DATA

problemtype:	CWE-264	Trust: 1.0
problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-284	Trust: 0.9

sources: VULHUB: VHN-102773 // JVNDB: JVNDB-2017-009270 // NVD: CVE-2017-12268

THREAT TYPE

local

Trust: 0.9

sources: BID: 101157 // CNNVD: CNNVD-201710-050

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201710-050

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-009270

PATCH

title:	cisco-sa-20171004-anam	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-anam	Trust: 0.8
title:	Cisco AnyConnect Secure Mobility Client Network Access Manager Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=75268	Trust: 0.6

sources: JVNDB: JVNDB-2017-009270 // CNNVD: CNNVD-201710-050

EXTERNAL IDS

db:	NVD	id:	CVE-2017-12268	Trust: 2.8
db:	BID	id:	101157	Trust: 2.0
db:	SECTRACK	id:	1039507	Trust: 1.7
db:	JVNDB	id:	JVNDB-2017-009270	Trust: 0.8
db:	CNNVD	id:	CNNVD-201710-050	Trust: 0.7
db:	VULHUB	id:	VHN-102773	Trust: 0.1

sources: VULHUB: VHN-102773 // BID: 101157 // JVNDB: JVNDB-2017-009270 // CNNVD: CNNVD-201710-050 // NVD: CVE-2017-12268

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20171004-anam	Trust: 2.0
url:	http://www.securityfocus.com/bid/101157	Trust: 1.7
url:	http://www.securitytracker.com/id/1039507	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12268	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-12268	Trust: 0.8
url:	http://www.cisco.com/c/en/us/products/security/anyconnect-secure-mobility-client/index.html	Trust: 0.3
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-102773 // BID: 101157 // JVNDB: JVNDB-2017-009270 // CNNVD: CNNVD-201710-050 // NVD: CVE-2017-12268

CREDITS

Cisco

Trust: 0.3

sources: BID: 101157

SOURCES

db:	VULHUB	id:	VHN-102773
db:	BID	id:	101157
db:	JVNDB	id:	JVNDB-2017-009270
db:	CNNVD	id:	CNNVD-201710-050
db:	NVD	id:	CVE-2017-12268

LAST UPDATE DATE

2025-04-20T23:30:51.899000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-102773	date:	2019-10-09T00:00:00
db:	BID	id:	101157	date:	2017-10-04T00:00:00
db:	JVNDB	id:	JVNDB-2017-009270	date:	2017-11-07T00:00:00
db:	CNNVD	id:	CNNVD-201710-050	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-12268	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-102773	date:	2017-10-05T00:00:00
db:	BID	id:	101157	date:	2017-10-04T00:00:00
db:	JVNDB	id:	JVNDB-2017-009270	date:	2017-11-07T00:00:00
db:	CNNVD	id:	CNNVD-201710-050	date:	2017-10-10T00:00:00
db:	NVD	id:	CVE-2017-12268	date:	2017-10-05T07:29:00.700