Medium severity · published Sep 23, 2022
CVE-2021-45035
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default
5.9
CVSS
0.5%
EPSS
No
On KEV
Description
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VC
Vclient · Velneo
28.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-45035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-45035
Vendor Advisory
https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados
Vendor Advisory
https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/
Third Party Advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication
Vendor Advisory
https://www.velneo.com/blog/nueva-revision-velneo-29-2
More from Vclient
7.4
CVE-2021-45036
Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the server