{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T10:16:39Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"Cisco-SA-20080115-CVE-2008-0324","slug":"cisco-sa-20080115-cve-2008-0324","vendor":"Cisco","title":"Cisco VPN Client IPSec Driver Kernel Memory Corruption Vulnerability","summary":"Cisco VPN Client for Windows version 5.0.02.0090 contains a vulnerability that could allow a local attacker to cause the affected system to fail and restart, resulting in a denial of service (DoS) condition. This vulnerability exists due to invalid memory operations. An attacker could exploit this vulnerability by running a program designed to make malicious requests to the affected application. As a result of processing these requests, the application could corrupt system memory,causing the system to fail and restart, thus denying service to legitimate users. Proof-of-concept code exists that demonstrates a DoS condition. Cisco has not confirmed this vulnerability and updates are not available. An attacker must log on locally to an affected system and run a program designed to submit malicious input to the affected application.  An exploit could cause the system to fail and restart, resulting in a DoS condition.  No evidence exists demonstrating that memory corruption resulting from an exploit could be leveraged to execute arbitrary code. Systems that could be most impacted by an exploit are multi-user systems.  Because VPN client software is often deployed on dedicated or single-user systems, a DoS may only affect the attacker or one other user on the local system.","severity":"Medium","published_at":"2008-01-15T22:42:03Z","updated_at":"2008-01-15T22:42:03Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20080115-CVE-2008-0324","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/Cisco-SA-20080115-CVE-2008-0324/csaf/Cisco-SA-20080115-CVE-2008-0324.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":1,"visible_product_count":1,"public_evidence_count":1,"kev_count":0,"highest_epss":0.01173},"cves":[{"id":"CVE-2008-0324","kev":false,"epss":{"score":0.01173,"percentile":0.64008,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"}}],"public_evidence":[{"product":{"name":"Cisco VPN Client for Windows","slug":"cisco-vpn-client-for-windows","vendor":"Cisco"},"cve":{"id":"CVE-2008-0324"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:20:28Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco VPN Client for Windows","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.01173,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2008-01-15T22:42:03Z","updated_at":"2008-01-15T22:42:03Z","advisory_updated_at":"2008-01-15T22:42:03Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20080115-CVE-2008-0324","row_display_order":1}]}