Read the docs
TI-2015-00642 Aliases CVE-2015-0691GHSA-7x5j-vqwr-gg77

A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD)…

Priority MEDIUM 46CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264 and CWE-78.

Summary

A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001.

Why it matters now

EPSS 0.03052 87th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 37

CPEVersionsRoleVendor
cpe:2.3:a:cisco:secure_desktop:3.0_base:*:*:*:*:*:*:*3.0_baseVulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.1.0.31:*:*:*:*:*:*:*3.1.0.31VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.1.1.45:*:*:*:*:*:*:*3.1.1.45VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.1_base:*:*:*:*:*:*:*3.1_baseVulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.2.0.136:*:*:*:*:*:*:*3.2.0.136VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.2.1.103:*:*:*:*:*:*:*3.2.1.103VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.2.1.126:*:*:*:*:*:*:*3.2.1.126VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.2_base:*:*:*:*:*:*:*3.2_baseVulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.3.0.118:*:*:*:*:*:*:*3.3.0.118VulnerableCisco
  • cpe:2.3:a:cisco:secure_desktop:3.0_base:*:*:*:*:*:*:* Versions 3.0_base Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.1.0.31:*:*:*:*:*:*:* Versions 3.1.0.31 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.1.1.45:*:*:*:*:*:*:* Versions 3.1.1.45 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.1_base:*:*:*:*:*:*:* Versions 3.1_base Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.2.0.136:*:*:*:*:*:*:* Versions 3.2.0.136 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.2.1.103:*:*:*:*:*:*:* Versions 3.2.1.103 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.2.1.126:*:*:*:*:*:*:* Versions 3.2.1.126 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.2_base:*:*:*:*:*:*:* Versions 3.2_base Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.3.0.118:*:*:*:*:*:*:* Versions 3.3.0.118 Vulnerable ·Cisco
Show 27 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:secure_desktop:3.3.0.151:*:*:*:*:*:*:*3.3.0.151VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.3_base:*:*:*:*:*:*:*3.3_baseVulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.4.0373:*:*:*:*:*:*:*3.4.0373VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.4.1108:*:*:*:*:*:*:*3.4.1108VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.4.2048:*:*:*:*:*:*:*3.4.2048VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.4_base:*:*:*:*:*:*:*3.4_baseVulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.5.841:*:*:*:*:*:*:*3.5.841VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.5.1077:*:*:*:*:*:*:*3.5.1077VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.5.2001:*:*:*:*:*:*:*3.5.2001VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.5.2003:*:*:*:*:*:*:*3.5.2003VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.5.2008:*:*:*:*:*:*:*3.5.2008VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.5_base:*:*:*:*:*:*:*3.5_baseVulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.181:*:*:*:*:*:*:*3.6.181VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.185:*:*:*:*:*:*:*3.6.185VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.1001:*:*:*:*:*:*:*3.6.1001VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.2002:*:*:*:*:*:*:*3.6.2002VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.3002:*:*:*:*:*:*:*3.6.3002VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.4021:*:*:*:*:*:*:*3.6.4021VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.5005:*:*:*:*:*:*:*3.6.5005VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.6020:*:*:*:*:*:*:*3.6.6020VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.6104:*:*:*:*:*:*:*3.6.6104VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.6203:*:*:*:*:*:*:*3.6.6203VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.6210:*:*:*:*:*:*:*3.6.6210VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.6228:*:*:*:*:*:*:*3.6.6228VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.6234:*:*:*:*:*:*:*3.6.6234VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6.6249:*:*:*:*:*:*:*3.6.6249VulnerableCisco
cpe:2.3:a:cisco:secure_desktop:3.6_base:*:*:*:*:*:*:*3.6_baseVulnerableCisco
  • cpe:2.3:a:cisco:secure_desktop:3.3.0.151:*:*:*:*:*:*:* Versions 3.3.0.151 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.3_base:*:*:*:*:*:*:* Versions 3.3_base Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.4.0373:*:*:*:*:*:*:* Versions 3.4.0373 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.4.1108:*:*:*:*:*:*:* Versions 3.4.1108 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.4.2048:*:*:*:*:*:*:* Versions 3.4.2048 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.4_base:*:*:*:*:*:*:* Versions 3.4_base Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.5.841:*:*:*:*:*:*:* Versions 3.5.841 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.5.1077:*:*:*:*:*:*:* Versions 3.5.1077 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.5.2001:*:*:*:*:*:*:* Versions 3.5.2001 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.5.2003:*:*:*:*:*:*:* Versions 3.5.2003 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.5.2008:*:*:*:*:*:*:* Versions 3.5.2008 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.5_base:*:*:*:*:*:*:* Versions 3.5_base Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.181:*:*:*:*:*:*:* Versions 3.6.181 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.185:*:*:*:*:*:*:* Versions 3.6.185 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.1001:*:*:*:*:*:*:* Versions 3.6.1001 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.2002:*:*:*:*:*:*:* Versions 3.6.2002 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.3002:*:*:*:*:*:*:* Versions 3.6.3002 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.4021:*:*:*:*:*:*:* Versions 3.6.4021 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.5005:*:*:*:*:*:*:* Versions 3.6.5005 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.6020:*:*:*:*:*:*:* Versions 3.6.6020 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.6104:*:*:*:*:*:*:* Versions 3.6.6104 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.6203:*:*:*:*:*:*:* Versions 3.6.6203 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.6210:*:*:*:*:*:*:* Versions 3.6.6210 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.6228:*:*:*:*:*:*:* Versions 3.6.6228 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.6234:*:*:*:*:*:*:* Versions 3.6.6234 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6.6249:*:*:*:*:*:*:* Versions 3.6.6249 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_desktop:3.6_base:*:*:*:*:*:*:* Versions 3.6_base Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-0691
  2. 2026-10-03 Alias added: GHSA-7x5j-vqwr-gg77

References

Advisory 1

  • TI-2011-00820 A certain ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) does not… CVSS 2.0HIGH 9.3
  • TI-2012-03968 The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate… CVSS 2.0HIGH 9.3
  • TI-2010-00561 The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before… CVSS 2.0HIGH 9.3
  • TI-2011-00819 The CSDWebInstallerCtrl ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop… CVSS 2.0HIGH 9.3
  • TI-2010-00418 Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop… CVSS 2.0MEDIUM 4.3
  • TI-2006-05205 Cisco Secure Desktop (CSD) does not require that the ClearPageFileAtShutdown (aka… CVSS 3.1MEDIUM 5.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences