Unscored severity · published Apr 15, 2010
CVE-2010-0589
The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote…
–
CVSS
4.8%
EPSS
No
On KEV
Description
The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Secure Desktop · Cisco
through 3.5; 3.1; 3.1.1; 3.1.1.27; 3.1.1.33; 3.2; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0589
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0589
securitytracker.com
http://securitytracker.com/id?1023881
Patch
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml
www.securityfocus.com
http://www.securityfocus.com/bid/39478
www.zerodayinitiative.com
http://www.zerodayinitiative.com/advisories/ZDI-10-072/
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/57812
More from Secure Desktop
5.5
CVE-2006-5393
Cisco Secure Desktop (CSD) does not require that the ClearPageFileAtShutdown (aka CCE-Winv2.0-407) registry value equals 1, which might allow local users to read certain memory…
–
CVE-2015-0691
A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID…
–
CVE-2012-4655
The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to…
–
CVE-2012-2495
The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of…
–
CVE-2011-0925
The CSDWebInstallerCtrl ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) allows remote attackers to download an unintended Cisco program onto a client machine,…