Cisco Plugs Critical Secure Desktop ActiveX Hole

The Cisco Secure Desktop contains a vulnerable ActiveX control that could allow an attacker to execute arbitrary code with the privileges of the user who is currently logged into the affected system, according to a warning from the networking vendor.

The company issued a patch alongside a warning that successful exploitation of this vulnerability could result in a "complete compromise of the affected system."

The details from Cisco's advisory:

A Cisco-signed ActiveX control that is used by Cisco Secure Desktop fails to properly verify the integrity of an executable file that is used by the Cisco Secure Desktop installation process. If an attacker can entice a user to visit an attacker controlled web page, the vulnerable ActiveX control could be invoked to download an attacker-modified package. The package could contain a malicious executable file that executes with the privileges of the affected user. A successful exploit could result in a complete compromise of a vulnerable system.

The issue affects Cisco Secure Desktop versions prior to 3.5.841.

Commenting on this Article is closed.