CVE-2020-3153

Known Exploited Vulnerability

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

Vendor / product: Cisco / AnyConnect Secure

Description

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

Weakness classification

• CWE-427: Uncontrolled Search Path Element

Primary references

• psirt@cisco.com — Exploit, Third Party Advisory, VDB Entry
• psirt@cisco.com — Exploit, Third Party Advisory, VDB Entry
• psirt@cisco.com — Exploit, Third Party Advisory, VDB Entry
• psirt@cisco.com — Exploit, Mailing List, Third Party Advisory
• psirt@cisco.com — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource