Unscored severity · published Feb 25, 2011
CVE-2011-0926
A certain ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) does not properly verify the signature of an unspecified downloaded program, which allows remote…
–
CVSS
6.8%
EPSS
No
On KEV
Description
A certain ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) does not properly verify the signature of an unspecified downloaded program, which allows remote attackers to execute arbitrary code by spoofing the CSD installation process, a different vulnerability than CVE-2010-0589.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.8% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Secure Desktop · Cisco
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0926
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0926
securityreason.com
http://securityreason.com/securityalert/8105
www.securityfocus.com
http://www.securityfocus.com/archive/1/516647/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/46536
www.securitytracker.com
http://www.securitytracker.com/id?1025118
www.vupen.com
http://www.vupen.com/english/advisories/2011/0513
www.zerodayinitiative.com
http://www.zerodayinitiative.com/advisories/ZDI-11-091/
More from Secure Desktop
5.5
CVE-2006-5393
Cisco Secure Desktop (CSD) does not require that the ClearPageFileAtShutdown (aka CCE-Winv2.0-407) registry value equals 1, which might allow local users to read certain memory…
–
CVE-2015-0691
A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID…
–
CVE-2012-4655
The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to…
–
CVE-2012-2495
The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of…
–
CVE-2011-0925
The CSDWebInstallerCtrl ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) allows remote attackers to download an unintended Cisco program onto a client machine,…