CVE-2021-45035mediumCWE-287

Velneo vClient Improper authentication

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.5%

exploitation probability

0.5%top 61% of all CVEs

observed exploitation

nono source reports it

Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Affected products

Velneo · Velneo vClient

References

https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication https://www.velneo.com/blog/nueva-revision-velneo-29-2