CVE-2016-6369
HighSummary
Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, allowing local users to gain privileges via a crafted INF file.
Risk Assessment
This vulnerability may lead to privilege escalation by local users, posing a risk of unauthorized access to the system.
Recommendation
It is recommended to update Cisco AnyConnect Secure Mobility Client to the latest version to mitigate this vulnerability.
Other vulnerabilities in Cisco AnyConnect Secure Mobility Client
See all- CVE-2015-0761High
Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, allowing local users to obtain root privileges via crafted vpnagent options.
- CVE-2015-0662High
Cisco AnyConnect Secure Mobility Client version 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger the use of root privileges for software-package installation.
- CVE-2020-3433HighActively exploited
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. The vulnerability is due to insufficient validation of resources loaded by the application. An attacker could send a crafted IPC message to the AnyConnect process, leading to arbitrary code execution with SYSTEM privileges.
- CVE-2020-3153MediumActively exploited
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to incorrect handling of directory paths.
Original NVD description (English source)
Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCuz92464.