Cisco AnyConnect Secure Mobility Client vulnerabilities
5 known CVE vulnerabilities in Cisco AnyConnect Secure Mobility Client, translated and rated.
- CVE-2016-6369High
Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, allowing local users to gain privileges via a crafted INF file.
- CVE-2015-0761High
Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, allowing local users to obtain root privileges via crafted vpnagent options.
- CVE-2015-0662High
Cisco AnyConnect Secure Mobility Client version 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger the use of root privileges for software-package installation.
- CVE-2020-3433HighActively exploited
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. The vulnerability is due to insufficient validation of resources loaded by the application. An attacker could send a crafted IPC message to the AnyConnect process, leading to arbitrary code execution with SYSTEM privileges.
- CVE-2020-3153MediumActively exploited
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to incorrect handling of directory paths.