Actively exploited in the wild
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
Cisco - AnyConnect Secure · Listed in the CISA KEV since 2022-10-24. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-3433
HighCVSS 7.8KEVExploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. The vulnerability is due to insufficient validation of resources loaded by the application. An attacker could send a crafted IPC message to the AnyConnect process, leading to arbitrary code execution with SYSTEM privileges.
Risk Assessment
A local attacker could gain full control of the system with SYSTEM privileges.
Recommendation
Install Cisco AnyConnect security updates.
Original NVD description (English source)
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.