CVE-2015-7600

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-10-06 · updated 2026-06-17
Weakness: CWE-264

Description

Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section.

Affected products

Cisco Vpn Client: 5.0, 5.0.01, 5.0.01.0600, 5.0.2, 5.0.02.0090, 5.0.2.0090 (+14)

References

http://www.securitytracker.com/id/1033750
https://www.nettitude.co.uk/vulnerability-discovered-in-unsupported-cisco-systems-vpn-client/
http://www.securitytracker.com/id/1033750
https://www.nettitude.co.uk/vulnerability-discovered-in-unsupported-cisco-systems-vpn-client/

Get alerted when CVE-2015-7600 or the next vulnerability affects your stack