CVE-2012-2495 describes a software downgrade vulnerability in Cisco AnyConnect Secure Mobility Client versions before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020. The HostScan downloader fails to compare timestamps, allowing remote attackers to force installation of older, potentially vulnerable software versions via ActiveX or Java components. Rated with a CVSS score of 4.3, this vulnerability has a network attack vector and medium attack complexity, leading to a potential integrity impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.0CPE matchmatch criteria | cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.0:*:*:*:*:*:*:* | ||
<= 3.5.2008CPE matchmatch criteria | cpe:2.3:a:cisco:secure_desktop:*:*:*:*:*:*:*:* | ||
3.1CPE matchmatch criteria | cpe:2.3:a:cisco:secure_desktop:3.1:*:*:*:*:*:*:* | ||
3.1.1CPE matchmatch criteria | cpe:2.3:a:cisco:secure_desktop:3.1.1:*:*:*:*:*:*:* | ||
3.1.1.27CPE matchmatch criteria | cpe:2.3:a:cisco:secure_desktop:3.1.1.27:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.