CVE-2015-0662
HighSummary
Cisco AnyConnect Secure Mobility Client version 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger the use of root privileges for software-package installation.
Risk Assessment
This vulnerability may allow local users unauthorized access to the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update Cisco AnyConnect Secure Mobility Client to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Cisco AnyConnect Secure Mobility Client
See all- CVE-2016-6369High
Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, allowing local users to gain privileges via a crafted INF file.
- CVE-2015-0761High
Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, allowing local users to obtain root privileges via crafted vpnagent options.
- CVE-2020-3433HighActively exploited
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. The vulnerability is due to insufficient validation of resources loaded by the application. An attacker could send a crafted IPC message to the AnyConnect process, leading to arbitrary code execution with SYSTEM privileges.
- CVE-2020-3153MediumActively exploited
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to incorrect handling of directory paths.
Original NVD description (English source)
Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385.