Medium · published February 20, 2020
CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 98.1th percentile for exploit probability.
⚠️ A crafty misstep in the Cisco AnyConnect installer lets a local attacker with valid credentials unleash chaos! Think of it like a hotel where guests can slip a malicious letter under the management's door, and the staff just tosses it into the management's inbox without checking — that's how this vulnerability allows attackers to insert harmful files into system directories without a second glance. An attacker could potentially overwrite important system files or execute malicious code with system-level privileges, leading to all sorts of mischief — from hijacking DLLs to installing backdoors. This could compromise not just the affected machine, but potentially the entire network!
Think of it like a hotel where guests can slip a malicious letter under the management's door, and the staff just tosses it into the management's inbox without checking — that's how this vulnerability allows attackers to insert harmful files into system directories without a second glance. The vulnerability arises from incorrect handling of directory paths in the Cisco AnyConnect Secure Mobility Client installer, allowing authenticated local users to copy files to arbitrary system-level directories.
An attacker could potentially overwrite important system files or execute malicious code with system-level privileges, leading to all sorts of mischief — from hijacking DLLs to installing backdoors. This could compromise not just the affected machine, but potentially the entire network! To secure your systems, update to the latest version of Cisco AnyConnect immediately, which addresses this flaw. Additionally, review user access permissions to ensure that only trusted personnel have local access. Regular audits can help catch any unauthorized changes! You've got this! By following these steps, you're on your way to securing your environment. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| cisco/anyconnect_secure_mobility_client | < 4.8.02042 | 4.8.02042 |