Skip to content
fr Sign in
7.1 High

CVE-2025-20206 A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an…

Description

A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client. This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid user credentials on the Windows system.

Affected products and versions

Product Affected versions Fixed in
Cisco Secure Client 5.1 5.1.0.136 → 5.1.7.80 No fix stated
Cisco Secure Client 5.0 5.0.00238 → 5.0.05040 No fix stated
Cisco Secure Client 4.10 4.10.00093 → 4.10.08029 No fix stated
Cisco Secure Client 4.9 4.9.00086 → 4.9.06037 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco Secure Client

The 10 CVEs of Cisco Secure Client →
CVE-2026-76462 A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure… 5.5 Medium CVE-2020-3432 A vulnerability in the uninstaller component of Cisco AnyConnect Secure Mobility Client for Mac OS could allow an… 5.6 Medium CVE-2024-20474 A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an… 4.3 Medium CVE-2024-20391 A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated… 6.8 Medium
Track this CVE