CVE-2011-2040

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client versions prior to 2.5.3041 Cisco AnyConnect Secure Mobility Client versions 3.0.x prior to 3.0.629

Description The issue allows remote attackers to execute arbitrary code via the url property to a Java applet. This is due to the helper application in Cisco AnyConnect Secure Mobility Client downloading a client executable file (vpndownloader.exe) without verifying its authenticity.

Recommendations For versions prior to 2.5.3041, update to version 2.5.3041 or later. For versions 3.0.x prior to 3.0.629, update to version 3.0.629 or later.