CVE-2015-7600

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securitytracker.com/id/1033750Third Party Advisory, VDB Entry
https://www.nettitude.co.uk/vulnerability-discovered-in-unsupported-cisco-systems-vpn-client/Exploit
http://www.securitytracker.com/id/1033750Third Party Advisory, VDB Entry
https://www.nettitude.co.uk/vulnerability-discovered-in-unsupported-cisco-systems-vpn-client/Exploit

Timeline

Published: Oct 6, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-76017.8Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..// (dot dot double sla CVE-2015-76027.8Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a R CVE-2015-76037.8Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backs CVE-2015-76044.3Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.6 and Splunk Light 6.2.x before 6.2.6 allows re CVE-2015-76096.1Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.CVE-2015-76108.8Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x befor CVE-2015-76118.1Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unsp CVE-2015-76126.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations page in Enterprise Manager in McAfee Vulnerability Manager (CVE-2015-76136.9Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc CVE-2015-76146.8Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrob CVE-2015-76156.8Use-after-free vulnerability in a SaveAs feature in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acroba CVE-2015-76166.8The ANVerifyComments method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic b