CVE-2014-3314: Cisco AnyConnect on Android and OS X does not properly verify the host type, which allows remote attackers...

Security readout for executives and security teams

Cisco AnyConnect clients on Android and OS X could show authentication forms for an untrusted or arbitrary host. A remote attacker may spoof a login prompt and possibly capture VPN credentials. The public bundle does not identify affected versions, fixed releases, or active exploitation. Organizations are most likely exposed if they still use Cisco AnyConnect clients on Android or OS X from the vulnerable timeframe. Exposure cannot be narrowed further from the supplied sources because affected and fixed versions are not listed in the bundle. Treat this as a credential-protection issue for legacy Cisco AnyConnect deployments. Prioritize confirming whether affected Android or OS X clients remain in use, then update per Cisco guidance and investigate any suspicious VPN prompt reports. Mitigation focus: Review Cisco's advisory for affected and fixed AnyConnect releases.; Update or replace Cisco AnyConnect clients according to Cisco guidance.; Use MDM or endpoint controls to enforce trusted VPN client profiles..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.