VulnerabilityModified
CVE-2021-45035
This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
MEDIUM 5.9EPSS 0.39%
Does this matter?
Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.
Description
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.39% probability · 33th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287, CWE-295
- Affected
- velneo/vclient
- Source
- cve-coordination@incibe.es
References
- https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificadosVendor Advisory
- https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/Vendor Advisory
- https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authenticationThird Party Advisory
- https://www.velneo.com/blog/nueva-revision-velneo-29-2Vendor Advisory
- https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificadosVendor Advisory
- https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/Vendor Advisory
- https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authenticationThird Party Advisory
- https://www.velneo.com/blog/nueva-revision-velneo-29-2Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.