CVE-2002-1096: Cisco VPN 3000 Concentrator Series Software

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.1, allows restricted administrators to obtain user passwords that are stored in plaintext in HTML source code.

Affected products

• Cisco VPN 3000 Concentrator Series Software: version 2.0 only; version 2.5.2.a only; version 2.5.2.b only; version 2.5.2.c only; version 2.5.2.d only; version 2.5.2.f only; …
• Cisco VPN 3002 Hardware Client: any version

Published 2002-10-04. Last modified 2026-06-16.