cisco anyconnect-secure-mobility-client CVE-2020-3153 is a vulnerability in Cisco Anyconnect Secure Mobility Client
Published on February 19, 2020

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

Vendor Advisory NVD

Known Exploited Vulnerability

This Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.

The following remediation steps are recommended / required by November 14, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2020-3153 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.0 out of four. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

What is a DLL preloading Vulnerability?

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

CVE-2020-3153 has been classified to as a DLL preloading vulnerability or weakness.


Products Associated with CVE-2020-3153

You can be notified by stack.watch whenever vulnerabilities like CVE-2020-3153 are published in these products:

Cisco Anyconnect Secure Mobility Client
 

What versions of Anyconnect Secure Mobility Client are vulnerable to CVE-2020-3153?