Actively exploited in the wild
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Cisco - AnyConnect Secure · Listed in the CISA KEV since 2022-10-24. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-3153
MediumCVSS 6.5KEVExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to incorrect handling of directory paths.
Risk Assessment
An attacker could copy malicious files to arbitrary locations with system privileges, potentially leading to system compromise, DLL pre-loading, DLL hijacking, and other attacks.
Recommendation
Apply updates provided by Cisco for AnyConnect Secure Mobility Client that address this vulnerability.
Original NVD description (English source)
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.