Cisco AnyConnect Secure Mobility Client VPNWeb ActiveX Code Execution

Added: 06/13/2011
CVE: CVE-2011-2039
BID: 48081
OSVDB: 72714


Cisco AnyConnect Secure Mobility Client provides remote mobile users with secure IPsec (IKEv2) or SSL Virtual Private Network (VPN) connections to Cisco 5500 Series Adaptive Security Appliances (ASA) and devices that are running Cisco IOS Software.


The AnyConnect Secure Mobility Client web deployment package uses an ActiveX control (vpnweb.ocx) to download and start the downloader application for the Secure Mobility Client application. A remote code execution vulnerability exists in the vpnweb.ocx ActiveX control because it fails to properly validate the authenticity of the downloaded executable when the client is deployed from the VPN headend. A remote attacker can exploit this vulnerability by enticing a user to open a specially crafted web page.


Cisco has released free software updates that address these vulnerabilities.



Exploit works on Cisco Systems AnyConnect Secure Mobility Client For Windows 2.3.0254.

The HTML page of the exploit must be opened using Internet Explorer 7 or 8 on the target.



Back to exploit index