CVE-2002-1106

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-10-04 · updated 2026-06-16

Description

Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.

Affected products

Cisco Vpn Client: 2.0, 3.0, 3.1, 3.5.1

References

http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml
http://www.securityfocus.com/bid/5652
https://exchange.xforce.ibmcloud.com/vulnerabilities/10045
http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml
http://www.securityfocus.com/bid/5652
https://exchange.xforce.ibmcloud.com/vulnerabilities/10045

Get alerted when CVE-2002-1106 or the next vulnerability affects your stack