CVE-2002-1106: Cisco VPN Client

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.

Affected products

• Cisco VPN Client: version 2.0 only; version 3.0 only; version 3.1 only; version 3.5.1 only

Published 2002-10-04. Last modified 2026-06-16.