medium6.3
CVE-2021-45035
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default.
Impact
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Velneo | Vclient | Version 28.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados
- https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/
- https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication
- https://www.velneo.com/blog/nueva-revision-velneo-29-2
- https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados
- https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/
- https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication
- https://www.velneo.com/blog/nueva-revision-velneo-29-2