What’s Vulnerable › Vulnerabilities

CVE-2010-3901

• Severity: medium (CVSS 6.4 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2010-10-14 · updated 2026-06-16
• Weakness: CWE-20

Description

OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1) does not correspond to the server hostname or (2) is presented in circumstances involving a missing --cafile configuration option.

Affected products

• Infradead Openconnect: through 2.22; 1.00, 1.10, 1.20, 1.30

References

• http://www.infradead.org/openconnect.html
• http://www.openwall.com/lists/oss-security/2010/08/01/1
• http://www.openwall.com/lists/oss-security/2010/08/02/7
• http://www.infradead.org/openconnect.html
• http://www.openwall.com/lists/oss-security/2010/08/01/1
• http://www.openwall.com/lists/oss-security/2010/08/02/7

Get alerted when CVE-2010-3901 or the next vulnerability affects your stack