CVE-2003-0258: Cisco VPN 3000 Concentrator Series Software

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client 3.5.x through 4.0.REL, when enabling IPSec over TCP for a port on the concentrator, allow remote attackers to reach the private network without authentication.

Affected products

• Cisco VPN 3000 Concentrator Series Software: version 3.5(rel) only; version 3.5.1 only; version 3.5.2 only; version 3.5.3 only; version 3.5.4 only; version 3.5.5 only; …
• Cisco VPN 3002 Hardware Client: any version
• Cisco VPN 3005 Concentrator Software: version 4.0.1 only
• Cisco VPN 3015 Concentrator: any version
• Cisco VPN 3030 Concentator: any version
• Cisco VPN 3060 Concentrator: any version
• Cisco VPN 3080 Concentrator: any version

Published 2003-05-27. Last modified 2026-06-16.