« Back to list

CVE-2010-0589

Status: ModifiedHigh (9.3)—

The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Cisco — Secure Desktop

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2010-0589",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-04-15T17:30:00.523",
  "references": [
    {
      "url": "http://securitytracker.com/id?1023881",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/39478",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/",
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://securitytracker.com/id?1023881",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/39478",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876."
    },
    {
      "lang": "es",
      "value": "El control ActiveX Web Install ActiveX en Cisco Secure Desktop (CSD) anterior a v3.5.841, no verifica adecuadamente las firmas de los programas descargados, lo que permite a atacantes remotos forzar las descargas y ejecuciones de archivos de su elección a través de una página web manipulada. También conocido con el Bug ID CSCta25876."
    }
  ],
  "lastModified": "2026-06-16T23:16:27.717",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B5E0489-A3D0-4FA8-BF36-7C329090F075",
              "versionEndIncluding": "3.5"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6EE6B79A-FD31-4637-BE22-EEADF63B94FF"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F2F8EA5-8DEF-48D0-9E7F-6047D4AECC5C"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1.27:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59D841B0-3D1B-4F1C-87F1-D0355955E49C"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1.33:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F13E414E-E56E-496E-A952-F93DCF1B1BDC"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D7A8878-2E0F-4140-86DF-75999B47E4F5"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4932BA9E-4156-4445-93E9-7A9F1D81090B"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3497EB29-C406-44C1-AB28-0DDC4E79A9D9"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C63D54D-6424-4767-9832-41E7F0B1D1E9"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4D4CF6F-2F81-45B0-9B5B-C8D79E74D6F4"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA0286A4-6011-41DF-B607-44CFBBFD437F"
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.2048:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE277431-4101-4C0F-91DB-A1C15C0344FF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}