CVE-2010-3901: Infradead Openconnect

Medium severity, CVSS 6.4. EPSS: 0.6% chance of exploitation in the next 30 days.

OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1) does not correspond to the server hostname or (2) is presented in circumstances involving a missing --cafile configuration option.

Affected products

• Infradead Openconnect: up to and including 2.22; version 1.00 only; version 1.10 only; version 1.20 only; version 1.30 only

Published 2010-10-14. Last modified 2026-06-16.