« Volver al listado

CVE-2010-0589

Estado: ModificadaAlta (9.3)—

The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Secure Desktop

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-0589",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-04-15T17:30:00.523",
  "references": [
    {
      "url": "http://securitytracker.com/id?1023881",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/39478",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/",
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://securitytracker.com/id?1023881",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/39478",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876."
    },
    {
      "lang": "es",
      "value": "El control ActiveX Web Install ActiveX en Cisco Secure Desktop (CSD) anterior a v3.5.841, no verifica adecuadamente las firmas de los programas descargados, lo que permite a atacantes remotos forzar las descargas y ejecuciones de archivos de su elección a través de una página web manipulada. También conocido con el Bug ID CSCta25876."
    }
  ],
  "lastModified": "2026-06-16T23:16:27.717",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B5E0489-A3D0-4FA8-BF36-7C329090F075",
              "versionEndIncluding": "3.5"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6EE6B79A-FD31-4637-BE22-EEADF63B94FF"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F2F8EA5-8DEF-48D0-9E7F-6047D4AECC5C"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1.27:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59D841B0-3D1B-4F1C-87F1-D0355955E49C"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1.33:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F13E414E-E56E-496E-A952-F93DCF1B1BDC"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D7A8878-2E0F-4140-86DF-75999B47E4F5"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4932BA9E-4156-4445-93E9-7A9F1D81090B"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3497EB29-C406-44C1-AB28-0DDC4E79A9D9"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C63D54D-6424-4767-9832-41E7F0B1D1E9"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4D4CF6F-2F81-45B0-9B5B-C8D79E74D6F4"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA0286A4-6011-41DF-B607-44CFBBFD437F"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.2048:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE277431-4101-4C0F-91DB-A1C15C0344FF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}