7.8
Élevée
CVE-2023-20178 A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco…
Description
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established. This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cisco Secure Client 5.0 | 5.0.00238 → 5.0.01242 | Pas de correctif indiqué |
| Cisco Secure Client 4.10 | 4.10.00093 → 4.10.06090 | Pas de correctif indiqué |
| Cisco Secure Client 4.9 | 4.9.00086 → 4.9.06037 | Pas de correctif indiqué |
Références
- cisco-sa-ac-csc-privesc-wx4U4Kw sec.cloudapps.cisco.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Cisco Secure Client
Les 10 CVE de Cisco Secure Client →
CVE-2026-76462
A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure…
5.5
Moyenne
CVE-2025-20206
A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an…
7.1
Élevée
CVE-2020-3432
A vulnerability in the uninstaller component of Cisco AnyConnect Secure Mobility Client for Mac OS could allow an…
5.6
Moyenne
CVE-2024-20474
A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an…
4.3
Moyenne