CVE-2011-2040: Cisco AnyConnect Secure Mobility Client

High severity, CVSS 9.3. EPSS: 10.7% chance of exploitation in the next 30 days.

The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629, on Linux and Mac OS X downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a Java applet, aka Bug ID CSCsy05934.

Affected products

• Cisco AnyConnect Secure Mobility Client: up to and including 2.5.2019; version 2.0 only; version 2.1 only; version 2.2 only; version 2.2.128 only; version 2.2.133 only; …

Published 2011-06-02. Last modified 2026-06-16.