What’s Vulnerable › Vulnerabilities

CVE-2021-45035: Velneo vClient Improper authentication

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-23 · updated 2026-06-17
• Weakness: CWE-287

Description

Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.

Affected products

• Velneo vClient: 28.1.3

References

• https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados
• https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/
• https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication
• https://www.velneo.com/blog/nueva-revision-velneo-29-2
• https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados
• https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/
• https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication
• https://www.velneo.com/blog/nueva-revision-velneo-29-2

Get alerted when CVE-2021-45035 or the next vulnerability affects your stack