PT-2022-12297 · Velneo · Velneo Vclient

Published 2022-09-23 · Updated 2023-07-21 · CVE-2021-45035

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Velneo vClient version 28.1.3

Description The issue arises from the default behavior of Velneo vClient, which does not correctly check the certificate of authenticity. This could allow an attacker with network access to perform a Man-in-the-Middle (MITM) attack, potentially obtaining the user's credentials.

Recommendations For Velneo vClient version 28.1.3, consider updating the configuration to correctly check the certificate of authenticity to prevent MITM attacks. As a temporary workaround, restrict network access to trusted sources until a proper fix is applied.

Fix

Improper Authentication

Improper Certificate Validation

Weakness Enumeration

CWE-287

CWE-295

Related Identifiers

CVE-2021-45035

Affected Products

Velneo Vclient

References · 8

• https://osv.dev/vulnerability/CVE-2021-45035 · Vendor Advisory
• https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035 · Vendor Advisory
• https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificados · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45035 · Security Note
• https://velneo.com/blog/nueva-revision-velneo-29-2 · Vendor Advisory
• https://incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authentication · Note
• https://t.me/cibsecurity/50362 · Telegram Post
• https://t.me/cvenotify/36843 · Telegram Post