CVE-2024-20474: medium-severity vulnerability in Cisco Secure Client
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.6%
A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of Cisco Secure Client.
This vulnerability is due to an integer underflow condition. An attacker could exploit this vulnerability by sending a crafted IKEv2 packet to an affected system. A successful exploit could allow the attacker to cause Cisco Secure Client Software to crash, resulting in a DoS condition on the client software.
Note: Cisco Secure Client Software releases 4.10 and earlier were known as Cisco AnyConnect Secure Mobility Client.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Cisco · Cisco Secure ClientRelated CVEs — Cisco Secure Client
In the same product, most dangerous first.
CVE-2024-20337HIGHCVE-2024-20337EPSS 29.9%CVE-2023-20178HIGHCVE-2023-20178EPSS 5.4%CVE-2024-20338HIGHCVE-2024-20338EPSS 0.9%CVE-2024-20391MEDIUMCVE-2024-20391EPSS 0.3%CVE-2020-3432MEDIUMCisco AnyConnect Secure Mobility Client for Mac OS File Corruption VulnerabilityEPSS 0.2%CVE-2023-20241MEDIUMCVE-2023-20241EPSS 0.2%