Privilege Escalation in Cisco AnyConnect via Temp Dir Misperm
CVE-2023-20178 Published on June 28, 2023
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established. This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.
Vulnerability Analysis
CVE-2023-20178 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Products Associated with CVE-2023-20178
stack.watch emails you whenever new vulnerabilities are published in Cisco Secure Client or Cisco Anyconnect Secure Mobility Client. Just hit a watch button to start following.
Affected Versions
Cisco Secure Client:- Version 4.9.00086 is affected.
- Version 4.9.01095 is affected.
- Version 4.9.02028 is affected.
- Version 4.9.03047 is affected.
- Version 4.9.03049 is affected.
- Version 4.9.04043 is affected.
- Version 4.9.04053 is affected.
- Version 4.9.05042 is affected.
- Version 4.9.06037 is affected.
- Version 4.10.00093 is affected.
- Version 4.10.01075 is affected.
- Version 4.10.02086 is affected.
- Version 4.10.03104 is affected.
- Version 4.10.04065 is affected.
- Version 4.10.04071 is affected.
- Version 4.10.05085 is affected.
- Version 4.10.05095 is affected.
- Version 4.10.05111 is affected.
- Version 4.10.06079 is affected.
- Version 4.10.06090 is affected.
- Version 5.0.00238 is affected.
- Version 5.0.00529 is affected.
- Version 5.0.00556 is affected.
- Version 5.0.01242 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.