CVE-2020-3153 is a vulnerability in Cisco Anyconnect Secure Mobility Client
Published on February 19, 2020
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
Known Exploited Vulnerability
This Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.
The following remediation steps are recommended / required by November 14, 2022: Apply updates per vendor instructions.
Weakness Type
What is a DLL preloading Vulnerability?
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CVE-2020-3153 has been classified to as a DLL preloading vulnerability or weakness.
Products Associated with CVE-2020-3153
Want to know whenever a new CVE is published for Cisco Anyconnect Secure Mobility Client? stack.watch will email you.
Affected Versions
Cisco AnyConnect Secure Mobility Client:- Version unspecified and below n/a is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.