CVE-2017-12268
Description
A vulnerability in the Network Access Manager (NAM) of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters, aka a Dual-Homed Interface vulnerability. The vulnerability is due to insufficient NAM policy enforcement. An attacker could exploit this vulnerability by manipulating network interfaces of the device to allow multiple active network interfaces. A successful exploit could allow the attacker to send traffic over a non-authorized network interface. Cisco Bug IDs: CSCvf66539.
Risk Information
Base Score
6.5
MODERATE
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.072
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerability CVE-2017-12268,CVE-2017-6788 are affected in Cisco AnyConnect Secure Mobility Client For Windows 4.5 | Windows |
| Vulnerabilities CVE-2017-12268 are affected in Any Connect (Microsoft Store) 4.5(822) | Windows |
| Cisco AnyConnect Network Access Manager Dual-Homed Interface Vulnerability For Cisco AnyConnect Secure Mobility Client | NCM |
| CVE-2017-12268 | NCM |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-1705981 | Security Update for Cisco AnyConnect Secure Mobility Client 4.3(2034) |
| PATCH-338372 | Cisco AnyConnect Secure Mobility Client (4.10.08029) (Manual Upload Required) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234