How severe is CVE-2007-4415?

CVE-2007-4415 has a CVSS 2.0 base score of 6.8, rated medium severity.

Is CVE-2007-4415 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-4415?

CVE-2007-4415 primarily affects Cisco Vpn Client. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2007-4415?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2007-4415 published?

CVE-2007-4415 was published on 2007-08-18 and last updated on 2026-06-16.

CVE-2007-4415

CVE-2007-4415 is a medium-severity vulnerability in Cisco Vpn Client with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 6.8)
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Cisco Vpn Client
Published: 2007-08-18
Last modified: 2026-06-16

Description

Cisco VPN Client on Windows before 5.0.01.0600, and the 5.0.01.0600 InstallShield (IS) release, uses weak permissions for cvpnd.exe (Modify granted to Interactive Users), which allows local users to gain privileges via a modified cvpnd.exe.

Frequently asked questions

What is CVE-2007-4415?: Cisco VPN Client on Windows before 5.0.01.0600, and the 5.0.01.0600 InstallShield (IS) release, uses weak permissions for cvpnd.exe (Modify granted to Interactive Users), which allows local users to gain privileges via a modified cvpnd.exe.
How severe is CVE-2007-4415?: CVE-2007-4415 has a CVSS 2.0 base score of 6.8, rated medium severity.
Is CVE-2007-4415 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2007-4415?: CVE-2007-4415 primarily affects Cisco Vpn Client. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2007-4415?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2007-4415 published?: CVE-2007-4415 was published on 2007-08-18 and last updated on 2026-06-16.

References

Affected products (2)

cpe:2.3:a:cisco:vpn_client:*:*:windows:*:*:*:*:*
cpe:2.3:a:cisco:vpn_client:5.0.01.0600:*:*:*:*:*:*:*

More vulnerabilities in Cisco Vpn Client

CVE-2002-1106 — High (CVSS 7.5): Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that…
CVE-2002-1107 — High (CVSS 7.5): Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.2B, does not generate sufficiently random…
CVE-2015-7600 — High (CVSS 7.2): Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain…
CVE-2006-2679 — High (CVSS 7.2): Unspecified vulnerability in the VPN Client for Windows Graphical User Interface (GUI) (aka the VPN client dialer) in…
CVE-2002-1447 — High (CVSS 7.2): Buffer overflow in the vpnclient program for UNIX VPN Client before 3.5.2 allows local users to gain administrative…
CVE-2012-3052 — Medium (CVSS 6.9): Untrusted search path vulnerability in Cisco VPN Client 5.0 allows local users to gain privileges via a Trojan horse…

All CVEs affecting Cisco Vpn Client →