CVE-2002-1106
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not...
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.
Exploit likelihood
What each source reports
NVD Score used
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.
- Record
CVE-2002-1106- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.
- Record
CVE-2002-1106- Updated
- 2026-11-02
EUVDEUVD-2002-1094 No score
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.
- Record
EUVD-2002-1094- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rpjg-66v9-rhx2 No score
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not...
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.
- Record
GHSA-rpjg-66v9-rhx2- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2002-1106 is a high vulnerability (CVSS 7.5) in Cisco Vpn Client, published October 4, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. No source names a fixed version.