← back
CVE-2015-6305

CVE-2015-6305

EPSS 1.2%
Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility Client 2.0 through 4.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by dbghelp.dll, aka Bug ID CSCuv01279. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4211.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/133876/Cisco-AnyConnect-Secure-Mobility-Client-3.1.08009-Privilege-Elevation.htmlunverifiedcve_referencewww.exploit-db.com/exploits/38289/unverifiedexploitdbwww.exploit-db.com/exploits/38289unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/133876/Cisco-AnyConnect-Secure-Mobility-Client-3.1.08009-Privilege-Elevation.htmlhttps://code.google.com/p/google-security-research/issues/detail?id=460http://seclists.org/fulldisclosure/2015/Sep/80https://www.exploit-db.com/exploits/38289/http://tools.cisco.com/security/center/viewAlert.x?alertId=41136http://www.securitytracker.com/id/1033643