CVE-2012-2493: Cisco AnyConnect Secure Mobility Client

High severity, CVSS 9.3. EPSS: 3.9% chance of exploitation in the next 30 days.

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug ID CSCtw47523.

Affected products

• Cisco AnyConnect Secure Mobility Client: version 2.0 only; version 2.1 only; version 2.2 only; version 2.2.128 only; version 2.2.133 only; version 2.2.136 only; …

Published 2012-06-20. Last modified 2026-06-16.