CVE-2021-45035

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287 CWE-295

Affected software

Vendor	Product	Versions
Velneo	Velneo vClient	28.1.3

References

https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificadosVendor Advisory
https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/Vendor Advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authenticationThird Party Advisory
https://www.velneo.com/blog/nueva-revision-velneo-29-2Vendor Advisory
https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificadosVendor Advisory
https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/Vendor Advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authenticationThird Party Advisory
https://www.velneo.com/blog/nueva-revision-velneo-29-2Vendor Advisory

Timeline

Published: Sep 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-450367.4Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the vict CVE-2021-450385.3An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attac CVE-2021-450399.8Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) CVE-2021-450409.8The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files vi CVE-2021-450418.8SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving reso CVE-2021-450424.9In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage back CVE-2021-450437.5HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.CVE-2021-450469.0It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could CVE-2021-450515.5Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an use-after-free vulnerability in the processing o CVE-2021-450525.5Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead CVE-2021-450537.8Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in CVE-2021-450545.5Adobe InCopy version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead t