CVE-2002-1098: Cisco VPN 3000 Concentrator Series Software

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

Cisco VPN 3000 Concentrator 2.2.x, and 3.x before 3.5.3, adds an "HTTPS on Public Inbound (XML-Auto)(forward/in)" rule but sets the protocol to "ANY" when the XML filter configuration is enabled, which ultimately allows arbitrary traffic to pass through the concentrator.

Affected products

• Cisco VPN 3000 Concentrator Series Software: version 2.0 only; version 2.5.2.a only; version 2.5.2.b only; version 2.5.2.c only; version 2.5.2.d only; version 2.5.2.f only; …
• Cisco VPN 3002 Hardware Client: any version

Published 2002-10-04. Last modified 2026-06-16.