CVE-2021-45035

Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.

• CWE-287
• CWE-295

• https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificadosVendor Advisory
• https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/Vendor Advisory
• https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authenticationThird Party Advisory
• https://www.velneo.com/blog/nueva-revision-velneo-29-2Vendor Advisory
• https://doc.velneo.com/v/29/velneo/notas-de-la-version#verificacion-de-certificadosVendor Advisory
• https://velneo.es/publicacion-de-incidencia-de-seguridad-en-cve-cve-2021-45035/Vendor Advisory
• https://www.incibe-cert.es/en/early-warning/security-advisories/velneo-vclient-improper-authenticationThird Party Advisory
• https://www.velneo.com/blog/nueva-revision-velneo-29-2Vendor Advisory

Published

Sep 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-45027An arbitrary file download vulnerability in Oliver v5 Librar…7.5
• CVE-2021-45029Groovy Code Injection & SpEL Injection which lead to Remote …9.8
• CVE-2021-45031A vulnerability in MEPSAN's USC+ before version 3.0 has a we…7.7
• CVE-2021-45032Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2021-45033A vulnerability has been identified in CP-8000 MASTER MODULE…8.8
• CVE-2021-45034A vulnerability has been identified in CP-8000 MASTER MODULE…7.5
• CVE-2021-45036Velneo vClient on its 28.1.3 version, could allow an attacke…7.4
• CVE-2021-45038An issue was discovered in MediaWiki before 1.35.5, 1.36.x b…5.3
• CVE-2021-45039Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6…9.8
• CVE-2021-45040The Spatie media-library-pro library through 1.17.10 and 2.x…9.8
• CVE-2021-45041SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authentic…8.8
• CVE-2021-45042In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x …4.9