Vulnerabilites related to cisco - secure_client
Vulnerability from fkie_nvd
Published
2023-06-28 15:15
Modified
2024-11-21 07:40
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established.
This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | anyconnect_secure_mobility_client | * | |
| cisco | secure_client | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:windows:*:*",
"matchCriteriaId": "9980A481-8A54-475A-B735-0C339FF30314",
"versionEndExcluding": "4.10.07061",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:*:*:*:*:*:windows:*:*",
"matchCriteriaId": "7A856448-9BF4-4693-A1EA-3B6C06DB4259",
"versionEndExcluding": "5.0.02075",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established.\r\n\r This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges."
}
],
"id": "CVE-2023-20178",
"lastModified": "2024-11-21T07:40:45.287",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-06-28T15:15:09.880",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-10-23 18:15
Modified
2024-11-01 18:14
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Summary
A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of Cisco Secure Client.
This vulnerability is due to an integer underflow condition. An attacker could exploit this vulnerability by sending a crafted IKEv2 packet to an affected system. A successful exploit could allow the attacker to cause Cisco Secure Client Software to crash, resulting in a DoS condition on the client software.
Note: Cisco Secure Client Software releases 4.10 and earlier were known as Cisco AnyConnect Secure Mobility Client.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.00086:*:*:*:*:*:*:*",
"matchCriteriaId": "03B6618B-2E98-480C-AF79-2A9E9BF29CB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.01095:*:*:*:*:*:*:*",
"matchCriteriaId": "F2CB76BE-7DD7-40D7-A7C7-DDA7079A286F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.02028:*:*:*:*:*:*:*",
"matchCriteriaId": "C87CEF61-99F2-4845-9FDE-4B6ED62637C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.03047:*:*:*:*:*:*:*",
"matchCriteriaId": "EA80A4E4-061E-4578-B780-9540AE502E66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.03049:*:*:*:*:*:*:*",
"matchCriteriaId": "804366C1-F307-4DC2-9FEA-B4EB60790A32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.04043:*:*:*:*:*:*:*",
"matchCriteriaId": "5AD3244A-5CA8-496C-B189-BCD31B0E40C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.04053:*:*:*:*:*:*:*",
"matchCriteriaId": "EAB00A32-8571-4685-B448-690F8EE373D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.05042:*:*:*:*:*:*:*",
"matchCriteriaId": "F97CC9FF-FDD3-46A1-9025-BAA83160A504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.06037:*:*:*:*:*:*:*",
"matchCriteriaId": "FF8E83C4-9C5A-4D84-AB19-A4564BBB6625",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.00093:*:*:*:*:*:*:*",
"matchCriteriaId": "8FDBC52F-F851-4DC4-9DED-45F8689F2A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.01075:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D74511-0444-473C-96F7-751C2B9A6ADC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.02086:*:*:*:*:*:*:*",
"matchCriteriaId": "D89BE767-38C2-4E92-83EB-09E23B48AAF8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.03104:*:*:*:*:*:*:*",
"matchCriteriaId": "DC77CA23-5750-4E35-AD17-4FE0B351ECFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.04065:*:*:*:*:*:*:*",
"matchCriteriaId": "CDE66231-01C3-4807-AB7B-F2A3C2E2200D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.04071:*:*:*:*:*:*:*",
"matchCriteriaId": "B003756D-7F3D-4FB9-B3EF-CEAA68334630",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.05085:*:*:*:*:*:*:*",
"matchCriteriaId": "B06F4BD8-23D2-4C32-B090-F33D50BB5805",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.05095:*:*:*:*:*:*:*",
"matchCriteriaId": "1EE93BD0-7AAD-4921-A6F1-22F1905F8870",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.05111:*:*:*:*:*:*:*",
"matchCriteriaId": "222718F2-81E9-40BD-8B2D-ECD70CC423E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.06079:*:*:*:*:*:*:*",
"matchCriteriaId": "C1150AC7-8E86-471E-87DD-F4C0D0628261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.06090:*:*:*:*:*:*:*",
"matchCriteriaId": "585A3B8E-8FD1-4B01-9F82-1038BF50A0FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.07061:*:*:*:*:*:*:*",
"matchCriteriaId": "61D0138A-EE54-420B-A11B-4580DD130FBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.07062:*:*:*:*:*:*:*",
"matchCriteriaId": "D45B8E46-AE9E-44F6-B58E-5AF7A32D499B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.07073:*:*:*:*:*:*:*",
"matchCriteriaId": "FAB896B8-535A-494F-AA21-3DA56CD7A540",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.08025:*:*:*:*:*:*:*",
"matchCriteriaId": "314BBB39-15FD-4DEB-8286-047644C4D456",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.08029:*:*:*:*:*:*:*",
"matchCriteriaId": "4877EEBA-CA94-4176-8442-429E9DF1E5AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.00238:*:*:*:*:*:*:*",
"matchCriteriaId": "7B7B74D9-7D43-48B2-AE6F-4FE75DB1DF61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.00529:*:*:*:*:*:*:*",
"matchCriteriaId": "86B5EB44-F814-49AB-BAD2-3E02E9707377",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.00556:*:*:*:*:*:*:*",
"matchCriteriaId": "C33CF946-24CD-471E-8448-445E629789BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.01242:*:*:*:*:*:*:*",
"matchCriteriaId": "9E39EE52-4A48-430E-A7A5-29276EE51B03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.02075:*:*:*:*:*:*:*",
"matchCriteriaId": "781CEBDC-3A42-47BA-8509-E35AB6BB56C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.03072:*:*:*:*:*:*:*",
"matchCriteriaId": "ADF3D714-0475-4E30-8245-159C5BA68F11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.03076:*:*:*:*:*:*:*",
"matchCriteriaId": "BA2D666F-5EBF-41B7-89C1-32BCF65DABEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.04032:*:*:*:*:*:*:*",
"matchCriteriaId": "DDDE95F2-E54E-4955-8E07-C8D97BCB2CC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.05040:*:*:*:*:*:*:*",
"matchCriteriaId": "DEF7A28D-542B-46A1-B428-BA3E71A62B44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.1.0.136:*:*:*:*:*:*:*",
"matchCriteriaId": "E38148BD-1C03-43F8-83F2-3043B3442100",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.1.1.42:*:*:*:*:*:*:*",
"matchCriteriaId": "C771F3C7-609D-4C66-B1A0-34BD26FFD781",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.1.2.42:*:*:*:*:*:*:*",
"matchCriteriaId": "A7D6AB12-BC84-4324-BB4E-AAC3701B28C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.1.3.62:*:*:*:*:*:*:*",
"matchCriteriaId": "0A560B61-73F1-42E5-9F4F-931610C6954A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of Cisco Secure Client.\r\n\r This vulnerability is due to an integer underflow condition. An attacker could exploit this vulnerability by sending a crafted IKEv2 packet to an affected system. A successful exploit could allow the attacker to cause Cisco Secure Client Software to crash, resulting in a DoS condition on the client software.\r\n\r Note: Cisco Secure Client Software releases 4.10 and earlier were known as Cisco AnyConnect Secure Mobility Client."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el procesamiento de la versi\u00f3n 2 de Internet Key Exchange (IKEv2) de Cisco Secure Client Software podr\u00eda permitir que un atacante remoto no autenticado provoque una denegaci\u00f3n de servicio (DoS) de Cisco Secure Client. Esta vulnerabilidad se debe a una condici\u00f3n de desbordamiento de enteros. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando un paquete IKEv2 manipulado a un sistema afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante provocar que Cisco Secure Client Software se bloquee, lo que provocar\u00eda una condici\u00f3n de DoS en el software cliente. Nota: Las versiones 4.10 y anteriores de Cisco Secure Client Software se conoc\u00edan como Cisco AnyConnect Secure Mobility Client."
}
],
"id": "CVE-2024-20474",
"lastModified": "2024-11-01T18:14:56.790",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-10-23T18:15:11.517",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csc-dos-XvPhM3bj"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-191"
}
],
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-191"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-03-05 17:15
Modified
2025-07-22 18:04
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client.
This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid user credentials on the Windows system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | secure_client | * | |
| microsoft | windows | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_client:*:*:*:*:*:*:*:*",
"matchCriteriaId": "461C334F-C41A-499A-9FD6-4453D45CC3B9",
"versionEndExcluding": "5.1.8.105",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client.\r\n\r\nThis vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid user credentials on the Windows system."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el canal de comunicaci\u00f3n entre procesos (IPC) de Cisco Secure Client para Windows podr\u00eda permitir que un atacante local autenticado realice un ataque de secuestro de DLL en un dispositivo afectado si Secure Firewall Posture Engine, anteriormente HostScan, est\u00e1 instalado en Cisco Secure Client. Esta vulnerabilidad se debe a una validaci\u00f3n insuficiente de los recursos que carga la aplicaci\u00f3n en tiempo de ejecuci\u00f3n. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando un mensaje IPC manipulado a un proceso espec\u00edfico de Cisco Secure Client. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante ejecutar c\u00f3digo arbitrario en la m\u00e1quina afectada con privilegios de SYSTEM. Para aprovechar esta vulnerabilidad, el atacante debe tener credenciales de usuario v\u00e1lidas en el sistema Windows."
}
],
"id": "CVE-2025-20206",
"lastModified": "2025-07-22T18:04:12.333",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-03-05T17:15:14.450",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-dll-injection-AOyzEqSg"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-347"
}
],
"source": "psirt@cisco.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-11-22 17:15
Modified
2024-11-21 07:40
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@cisco.com | https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8 | Issue Tracking, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.00086:*:*:*:*:*:*:*",
"matchCriteriaId": "03B6618B-2E98-480C-AF79-2A9E9BF29CB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.01095:*:*:*:*:*:*:*",
"matchCriteriaId": "F2CB76BE-7DD7-40D7-A7C7-DDA7079A286F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.02028:*:*:*:*:*:*:*",
"matchCriteriaId": "C87CEF61-99F2-4845-9FDE-4B6ED62637C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.03047:*:*:*:*:*:*:*",
"matchCriteriaId": "EA80A4E4-061E-4578-B780-9540AE502E66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.03049:*:*:*:*:*:*:*",
"matchCriteriaId": "804366C1-F307-4DC2-9FEA-B4EB60790A32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.04043:*:*:*:*:*:*:*",
"matchCriteriaId": "5AD3244A-5CA8-496C-B189-BCD31B0E40C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.04053:*:*:*:*:*:*:*",
"matchCriteriaId": "EAB00A32-8571-4685-B448-690F8EE373D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.05042:*:*:*:*:*:*:*",
"matchCriteriaId": "F97CC9FF-FDD3-46A1-9025-BAA83160A504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.06037:*:*:*:*:*:*:*",
"matchCriteriaId": "FF8E83C4-9C5A-4D84-AB19-A4564BBB6625",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.00093:*:*:*:*:*:*:*",
"matchCriteriaId": "8FDBC52F-F851-4DC4-9DED-45F8689F2A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.01075:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D74511-0444-473C-96F7-751C2B9A6ADC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.02086:*:*:*:*:*:*:*",
"matchCriteriaId": "D89BE767-38C2-4E92-83EB-09E23B48AAF8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.03104:*:*:*:*:*:*:*",
"matchCriteriaId": "DC77CA23-5750-4E35-AD17-4FE0B351ECFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.04065:*:*:*:*:*:*:*",
"matchCriteriaId": "CDE66231-01C3-4807-AB7B-F2A3C2E2200D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.04071:*:*:*:*:*:*:*",
"matchCriteriaId": "B003756D-7F3D-4FB9-B3EF-CEAA68334630",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.05085:*:*:*:*:*:*:*",
"matchCriteriaId": "B06F4BD8-23D2-4C32-B090-F33D50BB5805",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.05095:*:*:*:*:*:*:*",
"matchCriteriaId": "1EE93BD0-7AAD-4921-A6F1-22F1905F8870",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.05111:*:*:*:*:*:*:*",
"matchCriteriaId": "222718F2-81E9-40BD-8B2D-ECD70CC423E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.06079:*:*:*:*:*:*:*",
"matchCriteriaId": "C1150AC7-8E86-471E-87DD-F4C0D0628261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.06090:*:*:*:*:*:*:*",
"matchCriteriaId": "585A3B8E-8FD1-4B01-9F82-1038BF50A0FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.07061:*:*:*:*:*:*:*",
"matchCriteriaId": "61D0138A-EE54-420B-A11B-4580DD130FBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.07062:*:*:*:*:*:*:*",
"matchCriteriaId": "D45B8E46-AE9E-44F6-B58E-5AF7A32D499B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.07073:*:*:*:*:*:*:*",
"matchCriteriaId": "FAB896B8-535A-494F-AA21-3DA56CD7A540",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.00238:*:*:*:*:*:*:*",
"matchCriteriaId": "7B7B74D9-7D43-48B2-AE6F-4FE75DB1DF61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.00529:*:*:*:*:*:*:*",
"matchCriteriaId": "86B5EB44-F814-49AB-BAD2-3E02E9707377",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.00556:*:*:*:*:*:*:*",
"matchCriteriaId": "C33CF946-24CD-471E-8448-445E629789BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.01242:*:*:*:*:*:*:*",
"matchCriteriaId": "9E39EE52-4A48-430E-A7A5-29276EE51B03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.02075:*:*:*:*:*:*:*",
"matchCriteriaId": "781CEBDC-3A42-47BA-8509-E35AB6BB56C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.03072:*:*:*:*:*:*:*",
"matchCriteriaId": "ADF3D714-0475-4E30-8245-159C5BA68F11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.03076:*:*:*:*:*:*:*",
"matchCriteriaId": "BA2D666F-5EBF-41B7-89C1-32BCF65DABEC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en Cisco Secure Client Software, anteriormente AnyConnect Secure Mobility Client, podr\u00edan permitir que un atacante local autenticado cause una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un sistema afectado. Estas vulnerabilidades se deben a una lectura de memoria fuera de los l\u00edmites de Cisco Secure Client Software. Un atacante podr\u00eda aprovechar estas vulnerabilidades iniciando sesi\u00f3n en un dispositivo afectado al mismo tiempo que otro usuario accede a Cisco Secure Client en el mismo sistema y luego enviando paquetes manipulados a un puerto en ese host local. Un exploit exitoso podr\u00eda permitir al atacante bloquear el servicio del Agente VPN, provocando que no est\u00e9 disponible para todos los usuarios del sistema. Para explotar estas vulnerabilidades, el atacante debe tener credenciales v\u00e1lidas en un sistema multiusuario."
}
],
"id": "CVE-2023-20240",
"lastModified": "2024-11-21T07:40:58.247",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-22T17:15:18.520",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-03-06 17:15
Modified
2025-07-22 18:04
Severity ?
Summary
A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to elevate privileges on an affected device.
This vulnerability is due to the use of an uncontrolled search path element. An attacker could exploit this vulnerability by copying a malicious library file to a specific directory in the filesystem and persuading an administrator to restart a specific process. A successful exploit could allow the attacker to execute arbitrary code on an affected device with root privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | secure_client | * | |
| linux | linux_kernel | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_client:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8B8D47F6-7EDE-413E-823A-015F028BCE32",
"versionEndExcluding": "5.1.2.42",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to elevate privileges on an affected device.\r\n\r This vulnerability is due to the use of an uncontrolled search path element. An attacker could exploit this vulnerability by copying a malicious library file to a specific directory in the filesystem and persuading an administrator to restart a specific process. A successful exploit could allow the attacker to execute arbitrary code on an affected device with root privileges."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el m\u00f3dulo ISE Posture (System Scan) de Cisco Secure Client para Linux podr\u00eda permitir que un atacante local autenticado eleve los privilegios en un dispositivo afectado. Esta vulnerabilidad se debe al uso de un elemento de ruta de b\u00fasqueda no controlado. Un atacante podr\u00eda aprovechar esta vulnerabilidad copiando un archivo de librer\u00eda malicioso en un directorio espec\u00edfico del sistema de archivos y persuadiendo a un administrador para que reinicie un proceso espec\u00edfico. Un exploit exitoso podr\u00eda permitir al atacante ejecutar c\u00f3digo arbitrario en un dispositivo afectado con privilegios de root."
}
],
"id": "CVE-2024-20338",
"lastModified": "2025-07-22T18:04:59.510",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.3,
"impactScore": 5.9,
"source": "psirt@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-03-06T17:15:09.783",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-privesc-sYxQO6ds"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-privesc-sYxQO6ds"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-427"
}
],
"source": "psirt@cisco.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-11-22 17:15
Modified
2024-11-21 07:40
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system.
These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| psirt@cisco.com | https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8 | Issue Tracking, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.00086:*:*:*:*:*:*:*",
"matchCriteriaId": "03B6618B-2E98-480C-AF79-2A9E9BF29CB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.01095:*:*:*:*:*:*:*",
"matchCriteriaId": "F2CB76BE-7DD7-40D7-A7C7-DDA7079A286F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.02028:*:*:*:*:*:*:*",
"matchCriteriaId": "C87CEF61-99F2-4845-9FDE-4B6ED62637C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.03047:*:*:*:*:*:*:*",
"matchCriteriaId": "EA80A4E4-061E-4578-B780-9540AE502E66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.03049:*:*:*:*:*:*:*",
"matchCriteriaId": "804366C1-F307-4DC2-9FEA-B4EB60790A32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.04043:*:*:*:*:*:*:*",
"matchCriteriaId": "5AD3244A-5CA8-496C-B189-BCD31B0E40C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.04053:*:*:*:*:*:*:*",
"matchCriteriaId": "EAB00A32-8571-4685-B448-690F8EE373D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.05042:*:*:*:*:*:*:*",
"matchCriteriaId": "F97CC9FF-FDD3-46A1-9025-BAA83160A504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.06037:*:*:*:*:*:*:*",
"matchCriteriaId": "FF8E83C4-9C5A-4D84-AB19-A4564BBB6625",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.00093:*:*:*:*:*:*:*",
"matchCriteriaId": "8FDBC52F-F851-4DC4-9DED-45F8689F2A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.01075:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D74511-0444-473C-96F7-751C2B9A6ADC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.02086:*:*:*:*:*:*:*",
"matchCriteriaId": "D89BE767-38C2-4E92-83EB-09E23B48AAF8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.03104:*:*:*:*:*:*:*",
"matchCriteriaId": "DC77CA23-5750-4E35-AD17-4FE0B351ECFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.04065:*:*:*:*:*:*:*",
"matchCriteriaId": "CDE66231-01C3-4807-AB7B-F2A3C2E2200D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.04071:*:*:*:*:*:*:*",
"matchCriteriaId": "B003756D-7F3D-4FB9-B3EF-CEAA68334630",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.05085:*:*:*:*:*:*:*",
"matchCriteriaId": "B06F4BD8-23D2-4C32-B090-F33D50BB5805",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.05095:*:*:*:*:*:*:*",
"matchCriteriaId": "1EE93BD0-7AAD-4921-A6F1-22F1905F8870",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.05111:*:*:*:*:*:*:*",
"matchCriteriaId": "222718F2-81E9-40BD-8B2D-ECD70CC423E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.06079:*:*:*:*:*:*:*",
"matchCriteriaId": "C1150AC7-8E86-471E-87DD-F4C0D0628261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.06090:*:*:*:*:*:*:*",
"matchCriteriaId": "585A3B8E-8FD1-4B01-9F82-1038BF50A0FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.07061:*:*:*:*:*:*:*",
"matchCriteriaId": "61D0138A-EE54-420B-A11B-4580DD130FBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.07062:*:*:*:*:*:*:*",
"matchCriteriaId": "D45B8E46-AE9E-44F6-B58E-5AF7A32D499B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:4.10.07073:*:*:*:*:*:*:*",
"matchCriteriaId": "FAB896B8-535A-494F-AA21-3DA56CD7A540",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.00238:*:*:*:*:*:*:*",
"matchCriteriaId": "7B7B74D9-7D43-48B2-AE6F-4FE75DB1DF61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.00529:*:*:*:*:*:*:*",
"matchCriteriaId": "86B5EB44-F814-49AB-BAD2-3E02E9707377",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.00556:*:*:*:*:*:*:*",
"matchCriteriaId": "C33CF946-24CD-471E-8448-445E629789BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.01242:*:*:*:*:*:*:*",
"matchCriteriaId": "9E39EE52-4A48-430E-A7A5-29276EE51B03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.02075:*:*:*:*:*:*:*",
"matchCriteriaId": "781CEBDC-3A42-47BA-8509-E35AB6BB56C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.03072:*:*:*:*:*:*:*",
"matchCriteriaId": "ADF3D714-0475-4E30-8245-159C5BA68F11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:5.0.03076:*:*:*:*:*:*:*",
"matchCriteriaId": "BA2D666F-5EBF-41B7-89C1-32BCF65DABEC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system.\r\n\r These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en Cisco Secure Client Software, anteriormente AnyConnect Secure Mobility Client, podr\u00edan permitir que un atacante local autenticado cause una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un sistema afectado. Estas vulnerabilidades se deben a una lectura de memoria fuera de los l\u00edmites de Cisco Secure Client Software. Un atacante podr\u00eda aprovechar estas vulnerabilidades iniciando sesi\u00f3n en un dispositivo afectado al mismo tiempo que otro usuario accede a Cisco Secure Client en el mismo sistema y luego enviando paquetes manipulados a un puerto en ese host local. Un exploit exitoso podr\u00eda permitir al atacante bloquear el servicio del Agente VPN, provocando que no est\u00e9 disponible para todos los usuarios del sistema. Para explotar estas vulnerabilidades, el atacante debe tener credenciales v\u00e1lidas en un sistema multiusuario."
}
],
"id": "CVE-2023-20241",
"lastModified": "2024-11-21T07:40:58.370",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-22T17:15:18.740",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "psirt@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-03-06 17:15
Modified
2025-07-22 18:00
Severity ?
Summary
A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | secure_client | * | |
| cisco | secure_client | * | |
| apple | macos | - | |
| linux | linux_kernel | - | |
| microsoft | windows | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_client:*:*:*:*:*:*:*:*",
"matchCriteriaId": "10933A96-8975-4961-8804-9B75C6D2324B",
"versionEndExcluding": "4.10.08025",
"versionStartIncluding": "4.10.04065",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:*:*:*:*:*:*:*:*",
"matchCriteriaId": "207CA3FC-560B-470D-9117-0CE73A128BC1",
"versionEndExcluding": "5.1.2.42",
"versionStartIncluding": "5.0.00529",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. \r\n\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el proceso de autenticaci\u00f3n SAML de Cisco Secure Client podr\u00eda permitir que un atacante remoto no autenticado lleve a cabo un ataque de inyecci\u00f3n de avance de l\u00ednea de retorno de carro (CRLF) contra un usuario. Esta vulnerabilidad se debe a una validaci\u00f3n insuficiente de la entrada proporcionada por el usuario. Un atacante podr\u00eda aprovechar esta vulnerabilidad persuadiendo a un usuario para que haga clic en un enlace manipulado mientras establece una sesi\u00f3n VPN. Un exploit exitoso podr\u00eda permitir al atacante ejecutar c\u00f3digo de script arbitrario en el navegador o acceder a informaci\u00f3n confidencial basada en el navegador, incluido un token SAML v\u00e1lido. Luego, el atacante podr\u00eda usar el token para establecer una sesi\u00f3n VPN de acceso remoto con los privilegios del usuario afectado. Los hosts y servicios individuales detr\u00e1s de la cabecera VPN a\u00fan necesitar\u00edan credenciales adicionales para un acceso exitoso."
}
],
"id": "CVE-2024-20337",
"lastModified": "2025-07-22T18:00:37.350",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.7,
"source": "psirt@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-03-06T17:15:09.580",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-93"
}
],
"source": "psirt@cisco.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-05-15 18:15
Modified
2025-07-22 18:02
Severity ?
Summary
A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM.
This vulnerability is due to a lack of authentication on a specific function. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges on an affected device.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | secure_client | * | |
| microsoft | windows | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_client:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4FF362C4-2803-4CF9-83BE-34722F69E3E0",
"versionEndExcluding": "5.1.3.62",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM.\r\n\r This vulnerability is due to a lack of authentication on a specific function. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges on an affected device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el m\u00f3dulo Network Access Manager (NAM) de Cisco Secure Client podr\u00eda permitir que un atacante no autenticado con acceso f\u00edsico a un dispositivo afectado eleve privilegios al SYSTEM. Esta vulnerabilidad se debe a la falta de autenticaci\u00f3n en una funci\u00f3n espec\u00edfica. Un exploit exitoso podr\u00eda permitir al atacante ejecutar c\u00f3digo arbitrario con privilegios de SYSTEM en un dispositivo afectado."
}
],
"id": "CVE-2024-20391",
"lastModified": "2025-07-22T18:02:45.250",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.9,
"impactScore": 5.9,
"source": "psirt@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-05-15T18:15:10.153",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-nam-priv-esc-szu2vYpZ"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-nam-priv-esc-szu2vYpZ"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "psirt@cisco.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-05-06 19:15
Modified
2025-01-15 16:50
Severity ?
7.6 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
7.6 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
7.6 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Summary
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:*",
"matchCriteriaId": "F0918F54-0052-42BD-A73E-CFF198B9EC48",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*",
"matchCriteriaId": "81B7F626-84B5-47A5-959F-735D6250C147",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*",
"matchCriteriaId": "5E714EAF-73AB-41EA-AC57-E59B78FD7853",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:linux:*:*",
"matchCriteriaId": "7B728862-1FAB-47B4-823D-2C19CBF76DAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:macos:*:*",
"matchCriteriaId": "0A079CA4-D957-402A-B899-31F26A89DF00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:windows:*:*",
"matchCriteriaId": "6B512696-8596-4458-ADC9-24DD3C6C377B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:anyconnect_vpn_client:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59289E79-5A0A-4675-B7D4-C759401736A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:secure_client:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE81F5D2-269B-4098-AA9F-2DBCA3CB8813",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:iphone_os:*:*",
"matchCriteriaId": "8EEBB31D-BC9C-4EAD-86B1-8B95AB118A2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:linux:*:*",
"matchCriteriaId": "4814D5DB-A96C-4D91-9DAE-87FF0DA101D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
"matchCriteriaId": "72F88FEB-766B-4FCD-B78E-0E8E5E2B5CCA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
"matchCriteriaId": "D5537140-CDA3-4410-B101-24D1AB3624EA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CB344FC1-AD7C-4988-A703-8B2CD0AEF57C",
"versionEndExcluding": "24.06.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B5415705-33E5-46D5-8E4D-9EBADC8C5705",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:*",
"matchCriteriaId": "697D4070-101A-45B1-99B1-F33ECF03945C",
"versionEndExcluding": "24.8.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FB16CE4D-183C-44B9-A5FF-6F9FA3C0A618",
"versionEndIncluding": "7.2.5",
"versionStartIncluding": "7.2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A7F605E-EB10-40FB-98D6-7E3A95E310BC",
"versionEndIncluding": "15.1.10",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E8FEC1DE-D11F-4DC8-8B21-51BAF1731A5F",
"versionEndIncluding": "16.1.5",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9DE3A941-B898-4EAB-9073-C6A312E59FC5",
"versionEndIncluding": "17.1.2",
"versionStartIncluding": "17.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:watchguard:ipsec_mobile_vpn_client:*:*:*:*:*:macos:*:*",
"matchCriteriaId": "FFB4A7FD-AC96-490D-9CBB-72166D46C4FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:ipsec_mobile_vpn_client:*:*:*:*:*:windows:*:*",
"matchCriteriaId": "2EAD2DBA-3038-4EF8-8BAE-80BD3DA97B33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:macos:*:*",
"matchCriteriaId": "AB8A39F6-8AD5-4B9D-92E4-7E28EE78C5B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:windows:*:*",
"matchCriteriaId": "0AF97158-6BB8-47CA-8214-98D2F801C8BA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:*",
"matchCriteriaId": "1F206869-8FCE-40AE-ADDC-62F221E00004",
"versionEndExcluding": "1.5.1.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:macos:*:*",
"matchCriteriaId": "7D37D825-E2B8-4924-AA8A-ACB0E08A3C61",
"versionEndExcluding": "4.2.0.282",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:*",
"matchCriteriaId": "4EC77FDF-1E1A-4638-9C9F-DA4205FDD69B",
"versionEndExcluding": "3.7.0.134",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zscaler:client_connector:-:*:*:*:*:windows:*:*",
"matchCriteriaId": "C057E1BC-C7BA-4EAF-8200-560035118FA0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "DHCP can add routes to a client\u2019s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN."
},
{
"lang": "es",
"value": "Por dise\u00f1o, el protocolo DHCP no autentica mensajes, incluida, por ejemplo, la opci\u00f3n de ruta est\u00e1tica sin clases (121). Un atacante con la capacidad de enviar mensajes DHCP puede manipular rutas para redirigir el tr\u00e1fico VPN, lo que le permite leer, interrumpir o posiblemente modificar el tr\u00e1fico de red que se esperaba que estuviera protegido por la VPN. Muchos, si no la mayor\u00eda, de los sistemas VPN basados en enrutamiento IP son susceptibles a este tipo de ataques."
}
],
"id": "CVE-2024-3661",
"lastModified": "2025-01-15T16:50:28.667",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.7,
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-05-06T19:15:11.027",
"references": [
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Press/Media Coverage"
],
"url": "https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Vendor Advisory"
],
"url": "https://bst.cisco.com/quickview/bug/CSCwk05814"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Related"
],
"url": "https://datatracker.ietf.org/doc/html/rfc2131#section-7"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Related"
],
"url": "https://datatracker.ietf.org/doc/html/rfc3442#section-7"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Vendor Advisory"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-170"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Issue Tracking"
],
"url": "https://issuetracker.google.com/issues/263721377"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Press/Media Coverage"
],
"url": "https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Issue Tracking"
],
"url": "https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
],
"url": "https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Vendor Advisory"
],
"url": "https://my.f5.com/manage/s/article/K000139553"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Issue Tracking"
],
"url": "https://news.ycombinator.com/item?id=40279632"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Issue Tracking"
],
"url": "https://news.ycombinator.com/item?id=40284111"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Vendor Advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2024-3661"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Vendor Advisory"
],
"url": "https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://tunnelvisionbug.com/"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Related"
],
"url": "https://www.agwa.name/blog/post/hardening_openvpn_for_def_con"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
],
"url": "https://www.leviathansecurity.com/research/tunnelvision"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Press/Media Coverage"
],
"url": "https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009"
},
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Press/Media Coverage"
],
"url": "https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://bst.cisco.com/quickview/bug/CSCwk05814"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Related"
],
"url": "https://datatracker.ietf.org/doc/html/rfc2131#section-7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Related"
],
"url": "https://datatracker.ietf.org/doc/html/rfc3442#section-7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-170"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://issuetracker.google.com/issues/263721377"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Press/Media Coverage"
],
"url": "https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://my.f5.com/manage/s/article/K000139553"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://news.ycombinator.com/item?id=40279632"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://news.ycombinator.com/item?id=40284111"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2024-3661"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://tunnelvisionbug.com/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Related"
],
"url": "https://www.agwa.name/blog/post/hardening_openvpn_for_def_con"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.leviathansecurity.com/research/tunnelvision"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Press/Media Coverage"
],
"url": "https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability"
}
],
"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-306"
},
{
"lang": "en",
"value": "CWE-501"
}
],
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2023-20240 (GCVE-0-2023-20240)
Vulnerability from cvelistv5
Published
2023-11-22 17:10
Modified
2024-08-02 09:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-125 - Out-of-bounds Read
Summary
Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Secure Client |
Version: 4.9.00086 Version: 4.9.01095 Version: 4.9.02028 Version: 4.9.03047 Version: 4.9.03049 Version: 4.9.04043 Version: 4.9.04053 Version: 4.9.05042 Version: 4.9.06037 Version: 4.10.00093 Version: 4.10.01075 Version: 4.10.02086 Version: 4.10.03104 Version: 4.10.04065 Version: 4.10.04071 Version: 4.10.05085 Version: 4.10.05095 Version: 4.10.05111 Version: 4.10.06079 Version: 4.10.06090 Version: 4.10.07061 Version: 4.10.07062 Version: 4.10.07073 Version: 5.0.00238 Version: 5.0.00529 Version: 5.0.00556 Version: 5.0.01242 Version: 5.0.02075 Version: 5.0.03072 Version: 5.0.03076 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:05:35.707Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-accsc-dos-9SLzkZ8",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco Secure Client",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "4.9.00086"
},
{
"status": "affected",
"version": "4.9.01095"
},
{
"status": "affected",
"version": "4.9.02028"
},
{
"status": "affected",
"version": "4.9.03047"
},
{
"status": "affected",
"version": "4.9.03049"
},
{
"status": "affected",
"version": "4.9.04043"
},
{
"status": "affected",
"version": "4.9.04053"
},
{
"status": "affected",
"version": "4.9.05042"
},
{
"status": "affected",
"version": "4.9.06037"
},
{
"status": "affected",
"version": "4.10.00093"
},
{
"status": "affected",
"version": "4.10.01075"
},
{
"status": "affected",
"version": "4.10.02086"
},
{
"status": "affected",
"version": "4.10.03104"
},
{
"status": "affected",
"version": "4.10.04065"
},
{
"status": "affected",
"version": "4.10.04071"
},
{
"status": "affected",
"version": "4.10.05085"
},
{
"status": "affected",
"version": "4.10.05095"
},
{
"status": "affected",
"version": "4.10.05111"
},
{
"status": "affected",
"version": "4.10.06079"
},
{
"status": "affected",
"version": "4.10.06090"
},
{
"status": "affected",
"version": "4.10.07061"
},
{
"status": "affected",
"version": "4.10.07062"
},
{
"status": "affected",
"version": "4.10.07073"
},
{
"status": "affected",
"version": "5.0.00238"
},
{
"status": "affected",
"version": "5.0.00529"
},
{
"status": "affected",
"version": "5.0.00556"
},
{
"status": "affected",
"version": "5.0.01242"
},
{
"status": "affected",
"version": "5.0.02075"
},
{
"status": "affected",
"version": "5.0.03072"
},
{
"status": "affected",
"version": "5.0.03076"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-25T16:58:29.094Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-accsc-dos-9SLzkZ8",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8"
}
],
"source": {
"advisory": "cisco-sa-accsc-dos-9SLzkZ8",
"defects": [
"CSCwf21381"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2023-20240",
"datePublished": "2023-11-22T17:10:15.660Z",
"dateReserved": "2022-10-27T18:47:50.370Z",
"dateUpdated": "2024-08-02T09:05:35.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-3661 (GCVE-0-2024-3661)
Vulnerability from cvelistv5
Published
2024-05-06 18:31
Modified
2024-08-28 19:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:20:00.420Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://datatracker.ietf.org/doc/html/rfc2131#section-7"
},
{
"tags": [
"x_transferred"
],
"url": "https://datatracker.ietf.org/doc/html/rfc3442#section-7"
},
{
"tags": [
"x_transferred"
],
"url": "https://tunnelvisionbug.com/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.leviathansecurity.com/research/tunnelvision"
},
{
"tags": [
"x_transferred"
],
"url": "https://news.ycombinator.com/item?id=40279632"
},
{
"tags": [
"x_transferred"
],
"url": "https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/"
},
{
"tags": [
"x_transferred"
],
"url": "https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/"
},
{
"tags": [
"x_transferred"
],
"url": "https://issuetracker.google.com/issues/263721377"
},
{
"tags": [
"x_transferred"
],
"url": "https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability"
},
{
"tags": [
"x_transferred"
],
"url": "https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic"
},
{
"tags": [
"x_transferred"
],
"url": "https://news.ycombinator.com/item?id=40284111"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.agwa.name/blog/post/hardening_openvpn_for_def_con"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/"
},
{
"tags": [
"x_transferred"
],
"url": "https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009"
},
{
"tags": [
"x_transferred"
],
"url": "https://bst.cisco.com/quickview/bug/CSCwk05814"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.paloaltonetworks.com/CVE-2024-3661"
},
{
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-170"
},
{
"tags": [
"x_transferred"
],
"url": "https://my.f5.com/manage/s/article/K000139553"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3661",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-08T04:00:07.962328Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T19:09:06.995Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "DHCP",
"vendor": "IETF",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"datePublic": "2002-12-31T01:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DHCP can add routes to a client\u2019s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN."
}
],
"value": "DHCP can add routes to a client\u2019s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-501",
"description": "CWE-501 Trust Boundary Violation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-01T15:04:50.790Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"url": "https://datatracker.ietf.org/doc/html/rfc2131#section-7"
},
{
"url": "https://datatracker.ietf.org/doc/html/rfc3442#section-7"
},
{
"url": "https://tunnelvisionbug.com/"
},
{
"url": "https://www.leviathansecurity.com/research/tunnelvision"
},
{
"url": "https://news.ycombinator.com/item?id=40279632"
},
{
"url": "https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/"
},
{
"url": "https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/"
},
{
"url": "https://issuetracker.google.com/issues/263721377"
},
{
"url": "https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision"
},
{
"url": "https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability"
},
{
"url": "https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic"
},
{
"url": "https://news.ycombinator.com/item?id=40284111"
},
{
"url": "https://www.agwa.name/blog/post/hardening_openvpn_for_def_con"
},
{
"url": "https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/"
},
{
"url": "https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661"
},
{
"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009"
},
{
"url": "https://bst.cisco.com/quickview/bug/CSCwk05814"
},
{
"url": "https://security.paloaltonetworks.com/CVE-2024-3661"
},
{
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-170"
},
{
"url": "https://my.f5.com/manage/s/article/K000139553"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DHCP routing options can manipulate interface-based VPN traffic",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2024-3661",
"datePublished": "2024-05-06T18:31:21.217Z",
"dateReserved": "2024-04-11T17:24:22.637Z",
"dateUpdated": "2024-08-28T19:09:06.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20338 (GCVE-0-2024-20338)
Vulnerability from cvelistv5
Published
2024-03-06 16:29
Modified
2024-08-01 21:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-427 - Uncontrolled Search Path Element
Summary
A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to elevate privileges on an affected device.
This vulnerability is due to the use of an uncontrolled search path element. An attacker could exploit this vulnerability by copying a malicious library file to a specific directory in the filesystem and persuading an administrator to restart a specific process. A successful exploit could allow the attacker to execute arbitrary code on an affected device with root privileges.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Secure Client |
Version: N/A |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:*:*:*:*:*:linux:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"lessThan": "5.1.2.42",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-11T12:54:03.702303Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-26T18:05:28.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:59:42.263Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-secure-privesc-sYxQO6ds",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-privesc-sYxQO6ds"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco Secure Client",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to elevate privileges on an affected device.\r\n\r This vulnerability is due to the use of an uncontrolled search path element. An attacker could exploit this vulnerability by copying a malicious library file to a specific directory in the filesystem and persuading an administrator to restart a specific process. A successful exploit could allow the attacker to execute arbitrary code on an affected device with root privileges."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "Uncontrolled Search Path Element",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-06T16:29:33.440Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-secure-privesc-sYxQO6ds",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-privesc-sYxQO6ds"
}
],
"source": {
"advisory": "cisco-sa-secure-privesc-sYxQO6ds",
"defects": [
"CSCwi30539"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20338",
"datePublished": "2024-03-06T16:29:33.440Z",
"dateReserved": "2023-11-08T15:08:07.642Z",
"dateUpdated": "2024-08-01T21:59:42.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-20206 (GCVE-0-2025-20206)
Vulnerability from cvelistv5
Published
2025-03-05 16:14
Modified
2025-03-06 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Summary
A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client.
This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid user credentials on the Windows system.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Secure Client |
Version: 4.9.00086 Version: 4.9.01095 Version: 4.9.02028 Version: 4.9.03047 Version: 4.9.03049 Version: 4.9.04043 Version: 4.9.04053 Version: 4.9.05042 Version: 4.9.06037 Version: 4.10.00093 Version: 4.10.01075 Version: 4.10.02086 Version: 4.10.03104 Version: 4.10.04065 Version: 4.10.04071 Version: 4.10.05085 Version: 4.10.05095 Version: 5.0.00238 Version: 4.10.05111 Version: 5.0.00529 Version: 5.0.00556 Version: 4.10.06079 Version: 5.0.01242 Version: 4.10.06090 Version: 5.0.02075 Version: 4.10.07061 Version: 5.0.03072 Version: 4.10.07062 Version: 5.0.03076 Version: 5.0.04032 Version: 4.10.07073 Version: 5.0.05040 Version: 5.1.0.136 Version: 5.1.1.42 Version: 4.10.08025 Version: 5.1.2.42 Version: 4.10.08029 Version: 5.1.3.62 Version: 5.1.4.74 Version: 5.1.5.65 Version: 5.1.6.103 Version: 5.1.7.80 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-20206",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-06T04:55:26.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Secure Client",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "4.9.00086"
},
{
"status": "affected",
"version": "4.9.01095"
},
{
"status": "affected",
"version": "4.9.02028"
},
{
"status": "affected",
"version": "4.9.03047"
},
{
"status": "affected",
"version": "4.9.03049"
},
{
"status": "affected",
"version": "4.9.04043"
},
{
"status": "affected",
"version": "4.9.04053"
},
{
"status": "affected",
"version": "4.9.05042"
},
{
"status": "affected",
"version": "4.9.06037"
},
{
"status": "affected",
"version": "4.10.00093"
},
{
"status": "affected",
"version": "4.10.01075"
},
{
"status": "affected",
"version": "4.10.02086"
},
{
"status": "affected",
"version": "4.10.03104"
},
{
"status": "affected",
"version": "4.10.04065"
},
{
"status": "affected",
"version": "4.10.04071"
},
{
"status": "affected",
"version": "4.10.05085"
},
{
"status": "affected",
"version": "4.10.05095"
},
{
"status": "affected",
"version": "5.0.00238"
},
{
"status": "affected",
"version": "4.10.05111"
},
{
"status": "affected",
"version": "5.0.00529"
},
{
"status": "affected",
"version": "5.0.00556"
},
{
"status": "affected",
"version": "4.10.06079"
},
{
"status": "affected",
"version": "5.0.01242"
},
{
"status": "affected",
"version": "4.10.06090"
},
{
"status": "affected",
"version": "5.0.02075"
},
{
"status": "affected",
"version": "4.10.07061"
},
{
"status": "affected",
"version": "5.0.03072"
},
{
"status": "affected",
"version": "4.10.07062"
},
{
"status": "affected",
"version": "5.0.03076"
},
{
"status": "affected",
"version": "5.0.04032"
},
{
"status": "affected",
"version": "4.10.07073"
},
{
"status": "affected",
"version": "5.0.05040"
},
{
"status": "affected",
"version": "5.1.0.136"
},
{
"status": "affected",
"version": "5.1.1.42"
},
{
"status": "affected",
"version": "4.10.08025"
},
{
"status": "affected",
"version": "5.1.2.42"
},
{
"status": "affected",
"version": "4.10.08029"
},
{
"status": "affected",
"version": "5.1.3.62"
},
{
"status": "affected",
"version": "5.1.4.74"
},
{
"status": "affected",
"version": "5.1.5.65"
},
{
"status": "affected",
"version": "5.1.6.103"
},
{
"status": "affected",
"version": "5.1.7.80"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client.\r\n\r\nThis vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid user credentials on the Windows system."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-05T16:14:00.258Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-secure-dll-injection-AOyzEqSg",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-dll-injection-AOyzEqSg"
}
],
"source": {
"advisory": "cisco-sa-secure-dll-injection-AOyzEqSg",
"defects": [
"CSCwn03265"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Secure Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2025-20206",
"datePublished": "2025-03-05T16:14:00.258Z",
"dateReserved": "2024-10-10T19:15:13.230Z",
"dateUpdated": "2025-03-06T04:55:26.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-20178 (GCVE-0-2023-20178)
Vulnerability from cvelistv5
Published
2023-06-28 00:00
Modified
2024-08-02 09:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-276 - Incorrect Default Permissions
Summary
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established.
This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Secure Client |
Version: 4.9.00086 Version: 4.9.01095 Version: 4.9.02028 Version: 4.9.03047 Version: 4.9.03049 Version: 4.9.04043 Version: 4.9.04053 Version: 4.9.05042 Version: 4.9.06037 Version: 4.10.00093 Version: 4.10.01075 Version: 4.10.02086 Version: 4.10.03104 Version: 4.10.04065 Version: 4.10.04071 Version: 4.10.05085 Version: 4.10.05095 Version: 4.10.05111 Version: 4.10.06079 Version: 4.10.06090 Version: 5.0.00238 Version: 5.0.00529 Version: 5.0.00556 Version: 5.0.01242 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:05:34.960Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-ac-csc-privesc-wx4U4Kw",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco Secure Client",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "4.9.00086"
},
{
"status": "affected",
"version": "4.9.01095"
},
{
"status": "affected",
"version": "4.9.02028"
},
{
"status": "affected",
"version": "4.9.03047"
},
{
"status": "affected",
"version": "4.9.03049"
},
{
"status": "affected",
"version": "4.9.04043"
},
{
"status": "affected",
"version": "4.9.04053"
},
{
"status": "affected",
"version": "4.9.05042"
},
{
"status": "affected",
"version": "4.9.06037"
},
{
"status": "affected",
"version": "4.10.00093"
},
{
"status": "affected",
"version": "4.10.01075"
},
{
"status": "affected",
"version": "4.10.02086"
},
{
"status": "affected",
"version": "4.10.03104"
},
{
"status": "affected",
"version": "4.10.04065"
},
{
"status": "affected",
"version": "4.10.04071"
},
{
"status": "affected",
"version": "4.10.05085"
},
{
"status": "affected",
"version": "4.10.05095"
},
{
"status": "affected",
"version": "4.10.05111"
},
{
"status": "affected",
"version": "4.10.06079"
},
{
"status": "affected",
"version": "4.10.06090"
},
{
"status": "affected",
"version": "5.0.00238"
},
{
"status": "affected",
"version": "5.0.00529"
},
{
"status": "affected",
"version": "5.0.00556"
},
{
"status": "affected",
"version": "5.0.01242"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established.\r\n\r This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "Incorrect Default Permissions",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-25T16:57:50.608Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-ac-csc-privesc-wx4U4Kw",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw"
}
],
"source": {
"advisory": "cisco-sa-ac-csc-privesc-wx4U4Kw",
"defects": [
"CSCwe00252"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2023-20178",
"datePublished": "2023-06-28T00:00:00",
"dateReserved": "2022-10-27T00:00:00",
"dateUpdated": "2024-08-02T09:05:34.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20337 (GCVE-0-2024-20337)
Vulnerability from cvelistv5
Published
2024-03-06 16:30
Modified
2024-08-01 21:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Summary
A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Secure Client |
Version: 4.9.00086 Version: 4.9.01095 Version: 4.9.02028 Version: 4.9.03047 Version: 4.9.03049 Version: 4.9.04043 Version: 4.9.04053 Version: 4.9.05042 Version: 4.9.06037 Version: 4.10.00093 Version: 4.10.01075 Version: 4.10.02086 Version: 4.10.03104 Version: 4.10.04065 Version: 4.10.04071 Version: 4.10.05085 Version: 4.10.05095 Version: 4.10.05111 Version: 4.10.06079 Version: 4.10.06090 Version: 4.10.07061 Version: 4.10.07062 Version: 4.10.07073 Version: 5.0.00238 Version: 5.0.00529 Version: 5.0.00556 Version: 5.0.01242 Version: 5.0.02075 Version: 5.0.03072 Version: 5.0.03076 Version: 5.0.04032 Version: 5.0.05040 Version: 5.1.0.136 Version: 5.1.1.42 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.00093:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.01075:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.02086:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.03104:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.04065:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.04071:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.05085:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.05095:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.05111:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.06079:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.06090:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.07061:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.07062:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.10.07073:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.9.00086:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.9.01095:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.9.02028:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.9.03047:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.9.03049:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.9.04043:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.9.04053:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.9.05042:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:4.9.06037:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:5.0.00238:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:5.0.00529:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:5.0.00556:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:5.0.01242:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:5.0.02075:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:5.0.03072:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:5.0.03076:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:5.0.04032:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:5.1.0.136:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:secure_client:5.1.1.42:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.00093"
},
{
"status": "affected",
"version": "4.10.01075"
},
{
"status": "affected",
"version": "4.10.02086"
},
{
"status": "affected",
"version": "4.10.03104"
},
{
"status": "affected",
"version": "4.10.04065"
},
{
"status": "affected",
"version": "4.10.04071"
},
{
"status": "affected",
"version": "4.10.05085"
},
{
"status": "affected",
"version": "4.10.05095"
},
{
"status": "affected",
"version": "4.10.05111"
},
{
"status": "affected",
"version": "4.10.06079"
},
{
"status": "affected",
"version": "4.10.06090"
},
{
"status": "affected",
"version": "4.10.07061"
},
{
"status": "affected",
"version": "4.10.07062"
},
{
"status": "affected",
"version": "4.10.07073"
},
{
"status": "affected",
"version": "4.9.00086"
},
{
"status": "affected",
"version": "4.9.01095"
},
{
"status": "affected",
"version": "4.9.02028"
},
{
"status": "affected",
"version": "4.9.03047"
},
{
"status": "affected",
"version": "4.9.03049"
},
{
"status": "affected",
"version": "4.9.04043"
},
{
"status": "affected",
"version": "4.9.04053"
},
{
"status": "affected",
"version": "4.9.05042"
},
{
"status": "affected",
"version": "4.9.06037"
},
{
"status": "affected",
"version": "5.0.00238"
},
{
"status": "affected",
"version": "5.0.00529"
},
{
"status": "affected",
"version": "5.0.00556"
},
{
"status": "affected",
"version": "5.0.01242"
},
{
"status": "affected",
"version": "5.0.02075"
},
{
"status": "affected",
"version": "5.0.03072"
},
{
"status": "affected",
"version": "5.0.03076"
},
{
"status": "affected",
"version": "5.0.04032"
},
{
"status": "affected",
"version": "5.1.0.136"
},
{
"status": "affected",
"version": "5.1.1.42"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-09T05:00:57.702576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T17:00:36.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:59:42.871Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-secure-client-crlf-W43V4G7",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco Secure Client",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "4.9.00086"
},
{
"status": "affected",
"version": "4.9.01095"
},
{
"status": "affected",
"version": "4.9.02028"
},
{
"status": "affected",
"version": "4.9.03047"
},
{
"status": "affected",
"version": "4.9.03049"
},
{
"status": "affected",
"version": "4.9.04043"
},
{
"status": "affected",
"version": "4.9.04053"
},
{
"status": "affected",
"version": "4.9.05042"
},
{
"status": "affected",
"version": "4.9.06037"
},
{
"status": "affected",
"version": "4.10.00093"
},
{
"status": "affected",
"version": "4.10.01075"
},
{
"status": "affected",
"version": "4.10.02086"
},
{
"status": "affected",
"version": "4.10.03104"
},
{
"status": "affected",
"version": "4.10.04065"
},
{
"status": "affected",
"version": "4.10.04071"
},
{
"status": "affected",
"version": "4.10.05085"
},
{
"status": "affected",
"version": "4.10.05095"
},
{
"status": "affected",
"version": "4.10.05111"
},
{
"status": "affected",
"version": "4.10.06079"
},
{
"status": "affected",
"version": "4.10.06090"
},
{
"status": "affected",
"version": "4.10.07061"
},
{
"status": "affected",
"version": "4.10.07062"
},
{
"status": "affected",
"version": "4.10.07073"
},
{
"status": "affected",
"version": "5.0.00238"
},
{
"status": "affected",
"version": "5.0.00529"
},
{
"status": "affected",
"version": "5.0.00556"
},
{
"status": "affected",
"version": "5.0.01242"
},
{
"status": "affected",
"version": "5.0.02075"
},
{
"status": "affected",
"version": "5.0.03072"
},
{
"status": "affected",
"version": "5.0.03076"
},
{
"status": "affected",
"version": "5.0.04032"
},
{
"status": "affected",
"version": "5.0.05040"
},
{
"status": "affected",
"version": "5.1.0.136"
},
{
"status": "affected",
"version": "5.1.1.42"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. \r\n\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-06T16:30:02.285Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-secure-client-crlf-W43V4G7",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7"
}
],
"source": {
"advisory": "cisco-sa-secure-client-crlf-W43V4G7",
"defects": [
"CSCwi37512"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20337",
"datePublished": "2024-03-06T16:30:02.285Z",
"dateReserved": "2023-11-08T15:08:07.642Z",
"dateUpdated": "2024-08-01T21:59:42.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20474 (GCVE-0-2024-20474)
Vulnerability from cvelistv5
Published
2024-10-23 17:49
Modified
2024-10-23 20:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Summary
A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of Cisco Secure Client.
This vulnerability is due to an integer underflow condition. An attacker could exploit this vulnerability by sending a crafted IKEv2 packet to an affected system. A successful exploit could allow the attacker to cause Cisco Secure Client Software to crash, resulting in a DoS condition on the client software.
Note: Cisco Secure Client Software releases 4.10 and earlier were known as Cisco AnyConnect Secure Mobility Client.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Secure Client |
Version: 4.9.00086 Version: 4.9.01095 Version: 4.9.02028 Version: 4.9.03047 Version: 4.9.03049 Version: 4.9.04043 Version: 4.9.04053 Version: 4.9.05042 Version: 4.9.06037 Version: 4.10.00093 Version: 4.10.01075 Version: 4.10.02086 Version: 4.10.03104 Version: 4.10.04065 Version: 4.10.04071 Version: 4.10.05085 Version: 4.10.05095 Version: 4.10.05111 Version: 4.10.06079 Version: 4.10.06090 Version: 4.10.07061 Version: 4.10.07062 Version: 4.10.07073 Version: 4.10.08025 Version: 4.10.08029 Version: 5.0.00238 Version: 5.0.00529 Version: 5.0.00556 Version: 5.0.01242 Version: 5.0.02075 Version: 5.0.03072 Version: 5.0.03076 Version: 5.0.04032 Version: 5.0.05040 Version: 5.1.0.136 Version: 5.1.1.42 Version: 5.1.2.42 Version: 5.1.3.62 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20474",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-23T20:54:04.508420Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-23T20:54:12.513Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Secure Client",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "4.9.00086"
},
{
"status": "affected",
"version": "4.9.01095"
},
{
"status": "affected",
"version": "4.9.02028"
},
{
"status": "affected",
"version": "4.9.03047"
},
{
"status": "affected",
"version": "4.9.03049"
},
{
"status": "affected",
"version": "4.9.04043"
},
{
"status": "affected",
"version": "4.9.04053"
},
{
"status": "affected",
"version": "4.9.05042"
},
{
"status": "affected",
"version": "4.9.06037"
},
{
"status": "affected",
"version": "4.10.00093"
},
{
"status": "affected",
"version": "4.10.01075"
},
{
"status": "affected",
"version": "4.10.02086"
},
{
"status": "affected",
"version": "4.10.03104"
},
{
"status": "affected",
"version": "4.10.04065"
},
{
"status": "affected",
"version": "4.10.04071"
},
{
"status": "affected",
"version": "4.10.05085"
},
{
"status": "affected",
"version": "4.10.05095"
},
{
"status": "affected",
"version": "4.10.05111"
},
{
"status": "affected",
"version": "4.10.06079"
},
{
"status": "affected",
"version": "4.10.06090"
},
{
"status": "affected",
"version": "4.10.07061"
},
{
"status": "affected",
"version": "4.10.07062"
},
{
"status": "affected",
"version": "4.10.07073"
},
{
"status": "affected",
"version": "4.10.08025"
},
{
"status": "affected",
"version": "4.10.08029"
},
{
"status": "affected",
"version": "5.0.00238"
},
{
"status": "affected",
"version": "5.0.00529"
},
{
"status": "affected",
"version": "5.0.00556"
},
{
"status": "affected",
"version": "5.0.01242"
},
{
"status": "affected",
"version": "5.0.02075"
},
{
"status": "affected",
"version": "5.0.03072"
},
{
"status": "affected",
"version": "5.0.03076"
},
{
"status": "affected",
"version": "5.0.04032"
},
{
"status": "affected",
"version": "5.0.05040"
},
{
"status": "affected",
"version": "5.1.0.136"
},
{
"status": "affected",
"version": "5.1.1.42"
},
{
"status": "affected",
"version": "5.1.2.42"
},
{
"status": "affected",
"version": "5.1.3.62"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of Cisco Secure Client.\r\n\r This vulnerability is due to an integer underflow condition. An attacker could exploit this vulnerability by sending a crafted IKEv2 packet to an affected system. A successful exploit could allow the attacker to cause Cisco Secure Client Software to crash, resulting in a DoS condition on the client software.\r\n\r Note: Cisco Secure Client Software releases 4.10 and earlier were known as Cisco AnyConnect Secure Mobility Client."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-23T17:49:23.557Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-csc-dos-XvPhM3bj",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csc-dos-XvPhM3bj"
}
],
"source": {
"advisory": "cisco-sa-csc-dos-XvPhM3bj",
"defects": [
"CSCwj99060"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20474",
"datePublished": "2024-10-23T17:49:23.557Z",
"dateReserved": "2023-11-08T15:08:07.681Z",
"dateUpdated": "2024-10-23T20:54:12.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20391 (GCVE-0-2024-20391)
Vulnerability from cvelistv5
Published
2024-05-15 17:24
Modified
2024-08-01 21:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-306 - Missing Authentication for Critical Function
Summary
A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM.
This vulnerability is due to a lack of authentication on a specific function. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges on an affected device.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Secure Client |
Version: 4.9.00086 Version: 4.9.01095 Version: 4.9.02028 Version: 4.9.03047 Version: 4.9.03049 Version: 4.9.04043 Version: 4.9.04053 Version: 4.9.05042 Version: 4.9.06037 Version: 4.10.00093 Version: 4.10.01075 Version: 4.10.02086 Version: 4.10.03104 Version: 4.10.04065 Version: 4.10.04071 Version: 4.10.05085 Version: 4.10.05095 Version: 4.10.05111 Version: 4.10.06079 Version: 4.10.06090 Version: 4.10.07061 Version: 4.10.07062 Version: 4.10.07073 Version: 4.10.08025 Version: 4.10.08029 Version: 5.0.00238 Version: 5.0.00529 Version: 5.0.00556 Version: 5.0.01242 Version: 5.0.02075 Version: 5.0.03072 Version: 5.0.03076 Version: 5.0.04032 Version: 5.0.05040 Version: 5.1.0.136 Version: 5.1.1.42 Version: 5.1.2.42 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.9.01095:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.9.01095"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.9.02028:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.9.02028"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.9.03047:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.9.03047"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.9.03049:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.9.03049"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.9.04043:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.9.04043"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.9.04053:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.9.04053"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.9.05042:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.9.05042"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.9.06037:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.9.06037"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.00093:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.00093"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.01075:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.01075"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.02086:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.02086"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.03104:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.03104"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.04065:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.04065"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.04071:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.04071"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.05085:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.05085"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.05095:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.05095"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.05111:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.05111"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.06079:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.06079"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.06090:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.06090"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.07061:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.07061"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.07062:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.07062"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.07073:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.07073"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.08025:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.08025"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.10.08029:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.10.08029"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.0.00238:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.0.00238"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.0.00529:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.0.00529"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.0.00556:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.0.00556"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.0.01242:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.0.01242"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.0.02075:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.0.02075"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.0.03072:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.0.03072"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.0.03076:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.0.03076"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.0.04032:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.0.04032"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.0.05040:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.0.05040"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:4.9.00086:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "4.9.00086"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.1.0.136:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.1.0.136"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.1.1.42:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.1.1.42"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:secure_client:5.1.2.42:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secure_client",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "5.1.2.42"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T18:58:26.955767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:40:05.799Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:59:42.903Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-secure-nam-priv-esc-szu2vYpZ",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-nam-priv-esc-szu2vYpZ"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco Secure Client",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "4.9.00086"
},
{
"status": "affected",
"version": "4.9.01095"
},
{
"status": "affected",
"version": "4.9.02028"
},
{
"status": "affected",
"version": "4.9.03047"
},
{
"status": "affected",
"version": "4.9.03049"
},
{
"status": "affected",
"version": "4.9.04043"
},
{
"status": "affected",
"version": "4.9.04053"
},
{
"status": "affected",
"version": "4.9.05042"
},
{
"status": "affected",
"version": "4.9.06037"
},
{
"status": "affected",
"version": "4.10.00093"
},
{
"status": "affected",
"version": "4.10.01075"
},
{
"status": "affected",
"version": "4.10.02086"
},
{
"status": "affected",
"version": "4.10.03104"
},
{
"status": "affected",
"version": "4.10.04065"
},
{
"status": "affected",
"version": "4.10.04071"
},
{
"status": "affected",
"version": "4.10.05085"
},
{
"status": "affected",
"version": "4.10.05095"
},
{
"status": "affected",
"version": "4.10.05111"
},
{
"status": "affected",
"version": "4.10.06079"
},
{
"status": "affected",
"version": "4.10.06090"
},
{
"status": "affected",
"version": "4.10.07061"
},
{
"status": "affected",
"version": "4.10.07062"
},
{
"status": "affected",
"version": "4.10.07073"
},
{
"status": "affected",
"version": "4.10.08025"
},
{
"status": "affected",
"version": "4.10.08029"
},
{
"status": "affected",
"version": "5.0.00238"
},
{
"status": "affected",
"version": "5.0.00529"
},
{
"status": "affected",
"version": "5.0.00556"
},
{
"status": "affected",
"version": "5.0.01242"
},
{
"status": "affected",
"version": "5.0.02075"
},
{
"status": "affected",
"version": "5.0.03072"
},
{
"status": "affected",
"version": "5.0.03076"
},
{
"status": "affected",
"version": "5.0.04032"
},
{
"status": "affected",
"version": "5.0.05040"
},
{
"status": "affected",
"version": "5.1.0.136"
},
{
"status": "affected",
"version": "5.1.1.42"
},
{
"status": "affected",
"version": "5.1.2.42"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM.\r\n\r This vulnerability is due to a lack of authentication on a specific function. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges on an affected device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-15T17:24:34.138Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-secure-nam-priv-esc-szu2vYpZ",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-nam-priv-esc-szu2vYpZ"
}
],
"source": {
"advisory": "cisco-sa-secure-nam-priv-esc-szu2vYpZ",
"defects": [
"CSCwj48522"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20391",
"datePublished": "2024-05-15T17:24:34.138Z",
"dateReserved": "2023-11-08T15:08:07.659Z",
"dateUpdated": "2024-08-01T21:59:42.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-20241 (GCVE-0-2023-20241)
Vulnerability from cvelistv5
Published
2023-11-22 17:10
Modified
2025-06-05 14:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-125 - Out-of-bounds Read
Summary
Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system.
These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Secure Client |
Version: 4.9.00086 Version: 4.9.01095 Version: 4.9.02028 Version: 4.9.03047 Version: 4.9.03049 Version: 4.9.04043 Version: 4.9.04053 Version: 4.9.05042 Version: 4.9.06037 Version: 4.10.00093 Version: 4.10.01075 Version: 4.10.02086 Version: 4.10.03104 Version: 4.10.04065 Version: 4.10.04071 Version: 4.10.05085 Version: 4.10.05095 Version: 4.10.05111 Version: 4.10.06079 Version: 4.10.06090 Version: 4.10.07061 Version: 4.10.07062 Version: 4.10.07073 Version: 5.0.00238 Version: 5.0.00529 Version: 5.0.00556 Version: 5.0.01242 Version: 5.0.02075 Version: 5.0.03072 Version: 5.0.03076 Version: 5.0.04032 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:05:35.856Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-accsc-dos-9SLzkZ8",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-20241",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-05T14:22:24.777282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-05T14:23:54.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Secure Client",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "4.9.00086"
},
{
"status": "affected",
"version": "4.9.01095"
},
{
"status": "affected",
"version": "4.9.02028"
},
{
"status": "affected",
"version": "4.9.03047"
},
{
"status": "affected",
"version": "4.9.03049"
},
{
"status": "affected",
"version": "4.9.04043"
},
{
"status": "affected",
"version": "4.9.04053"
},
{
"status": "affected",
"version": "4.9.05042"
},
{
"status": "affected",
"version": "4.9.06037"
},
{
"status": "affected",
"version": "4.10.00093"
},
{
"status": "affected",
"version": "4.10.01075"
},
{
"status": "affected",
"version": "4.10.02086"
},
{
"status": "affected",
"version": "4.10.03104"
},
{
"status": "affected",
"version": "4.10.04065"
},
{
"status": "affected",
"version": "4.10.04071"
},
{
"status": "affected",
"version": "4.10.05085"
},
{
"status": "affected",
"version": "4.10.05095"
},
{
"status": "affected",
"version": "4.10.05111"
},
{
"status": "affected",
"version": "4.10.06079"
},
{
"status": "affected",
"version": "4.10.06090"
},
{
"status": "affected",
"version": "4.10.07061"
},
{
"status": "affected",
"version": "4.10.07062"
},
{
"status": "affected",
"version": "4.10.07073"
},
{
"status": "affected",
"version": "5.0.00238"
},
{
"status": "affected",
"version": "5.0.00529"
},
{
"status": "affected",
"version": "5.0.00556"
},
{
"status": "affected",
"version": "5.0.01242"
},
{
"status": "affected",
"version": "5.0.02075"
},
{
"status": "affected",
"version": "5.0.03072"
},
{
"status": "affected",
"version": "5.0.03076"
},
{
"status": "affected",
"version": "5.0.04032"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system.\r\n\r These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-25T16:58:29.398Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-accsc-dos-9SLzkZ8",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8"
}
],
"source": {
"advisory": "cisco-sa-accsc-dos-9SLzkZ8",
"defects": [
"CSCwf92553"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2023-20241",
"datePublished": "2023-11-22T17:10:45.694Z",
"dateReserved": "2022-10-27T18:47:50.370Z",
"dateUpdated": "2025-06-05T14:23:54.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}