CVE-2020-3153mediumunder attackransomwareCWE-427

CVE-2020-3153: medium-severity vulnerability in Cisco AnyConnect Secure Mobility Client

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

Published · Updated

Follow this CVE+ Monitor Cisco AnyConnect Secure Mobility Client

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

88Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 6.5epss 29%
from disclosure to weapon75 days
Published on NVDFeb 19
1st PoC+75d
metasploit+168d
CISA KEV+978d
Action required by CISAfederal deadline: 2022-11-14

Apply updates per vendor instructions.

In short

A flaw in Cisco AnyConnect's installer for Windows allows an authenticated attacker to place malicious files into system directories with elevated privileges. This could enable DLL hijacking attacks that compromise system security.

Technical detail

An uncontrolled search path vulnerability in the AnyConnect Windows installer component permits authenticated local attackers to write arbitrary files to system-level directories with SYSTEM privileges through improper directory path handling. This enables DLL pre-loading and hijacking attacks; exploitation requires valid local credentials on the target system.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Affected products
Cisco · Cisco AnyConnect Secure Mobility Client
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco AnyConnect Secure Mobility Client

In the same product, most dangerous first.

CVE-2020-3433HIGHCisco AnyConnect Secure Mobility Client for Windows DLL Hijacking VulnerabilityEPSS 10.0%KEVCVE-2019-1853MEDIUMCisco AnyConnect Secure Mobility Client for Linux Out-of-Bounds Memory Read VulnerabilityEPSS 1.6%CVE-2021-1366HIGHCisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking VulnerabilityEPSS 1.3%CVE-2021-1496HIGHCisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesEPSS 0.5%CVE-2020-3434MEDIUMCisco AnyConnect Secure Mobility Client for Windows Denial of Service VulnerabilityEPSS 0.5%CVE-2020-3556HIGHCisco AnyConnect Secure Mobility Client Arbitrary Code Execution VulnerabilityEPSS 0.4%