Denial of Service Vulnerability in Cisco VPN Client for Windows
CVE-2009-4118
Currently unrated
Key Information:
- Vendor
Cisco
- Status
- Vendor
- CVE Published:
- 1 December 2009
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2009-4118?
The cvpnd service in the Cisco VPN Client for Windows prior to version 5.0.06.0100 is susceptible to a denial of service issue. This vulnerability arises when the StartServiceCtrlDispatcher function inadequately manages the ERROR_FAILED_SERVICE_CONTROLLER_CONNECT error. An attacker with local access can exploit this weakness to manually initiate the cvpnd.exe process, leading to a crash of the service and a subsequent loss of VPN connectivity.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.