CVE-2023-20178
HighCVSS 7.8Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The issue exists because improper permissions are assigned to a temporary directory created during the update process.
Risk Assessment
An attacker with local access and low privileges can gain full control of the system as SYSTEM, posing a serious threat to confidentiality, integrity, and availability. Requires prior authentication and local access.
Recommendation
Update Cisco AnyConnect Secure Mobility Client and Cisco Secure Client to the latest patched version. Restrict local access to systems with the client installed.
Other vulnerabilities in Cisco AnyConnect Secure Mobility Client
See all- CVE-2016-6369High
Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, allowing local users to gain privileges via a crafted INF file.
- CVE-2015-0761High
Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, allowing local users to obtain root privileges via crafted vpnagent options.
- CVE-2015-0662High
Cisco AnyConnect Secure Mobility Client version 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger the use of root privileges for software-package installation.
- CVE-2020-3433HighActively exploited
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. The vulnerability is due to insufficient validation of resources loaded by the application. An attacker could send a crafted IPC message to the AnyConnect process, leading to arbitrary code execution with SYSTEM privileges.
- CVE-2020-3153MediumActively exploited
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to incorrect handling of directory paths.
Original NVD description (English source)
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established. This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS