CVE-2016-6369: High severity cisco anyconnect secure vulnerability

Published Aug 25, 2016
·
Updated

Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCuz92464.

Affected Software

57 affected components
cisco AnyConnect Secure Mobility Client=2.0.0343
cisco AnyConnect Secure Mobility Client=2.1.0148
cisco AnyConnect Secure Mobility Client=2.2.0133
cisco AnyConnect Secure Mobility Client=2.2.0136
cisco AnyConnect Secure Mobility Client=2.2.0140
cisco AnyConnect Secure Mobility Client=2.3.0185
cisco AnyConnect Secure Mobility Client=2.3.0254
cisco AnyConnect Secure Mobility Client=2.3.1003
cisco AnyConnect Secure Mobility Client=2.3.2016
cisco AnyConnect Secure Mobility Client=2.4.0202
cisco AnyConnect Secure Mobility Client=2.4.1012
cisco AnyConnect Secure Mobility Client=2.5.0217
cisco AnyConnect Secure Mobility Client=2.5.2006
cisco AnyConnect Secure Mobility Client=2.5.2010
cisco AnyConnect Secure Mobility Client=2.5.2011
cisco AnyConnect Secure Mobility Client=2.5.2014
cisco AnyConnect Secure Mobility Client=2.5.2017
cisco AnyConnect Secure Mobility Client=2.5.2018
cisco AnyConnect Secure Mobility Client=2.5.2019
cisco AnyConnect Secure Mobility Client=2.5.3041
cisco AnyConnect Secure Mobility Client=2.5.3046
cisco AnyConnect Secure Mobility Client=2.5.3051
cisco AnyConnect Secure Mobility Client=2.5.3054
cisco AnyConnect Secure Mobility Client=2.5.3055
cisco AnyConnect Secure Mobility Client=2.5_base
cisco AnyConnect Secure Mobility Client=3.0.0
cisco AnyConnect Secure Mobility Client=3.0.0629
cisco AnyConnect Secure Mobility Client=3.0.1047
cisco AnyConnect Secure Mobility Client=3.0.2052
cisco AnyConnect Secure Mobility Client=3.0.3050
cisco AnyConnect Secure Mobility Client=3.0.3054
cisco AnyConnect Secure Mobility Client=3.0.4235
cisco AnyConnect Secure Mobility Client=3.0.5075
cisco AnyConnect Secure Mobility Client=3.0.5080
cisco AnyConnect Secure Mobility Client=3.0.09231
cisco AnyConnect Secure Mobility Client=3.0.09266
cisco AnyConnect Secure Mobility Client=3.0.09353
cisco AnyConnect Secure Mobility Client=3.1\(60\)
cisco AnyConnect Secure Mobility Client=3.1.0
cisco AnyConnect Secure Mobility Client=3.1.02043
cisco AnyConnect Secure Mobility Client=3.1.05182
cisco AnyConnect Secure Mobility Client=3.1.05187
cisco AnyConnect Secure Mobility Client=3.1.06073
cisco AnyConnect Secure Mobility Client=3.1.07021
cisco AnyConnect Secure Mobility Client=4.0\(48\)
cisco AnyConnect Secure Mobility Client=4.0\(64\)
cisco AnyConnect Secure Mobility Client=4.0\(2049\)
cisco AnyConnect Secure Mobility Client=4.0.0
cisco AnyConnect Secure Mobility Client=4.0.00048
cisco AnyConnect Secure Mobility Client=4.0.00051
cisco AnyConnect Secure Mobility Client=4.1\(8\)
cisco AnyConnect Secure Mobility Client=4.1.0
cisco AnyConnect Secure Mobility Client=4.2.0
cisco AnyConnect Secure Mobility Client=4.2.04039
cisco AnyConnect Secure Mobility Client=4.3.0
cisco AnyConnect Secure Mobility Client=4.3.00748
cisco AnyConnect Secure Mobility Client=4.3.01095

Event History

Aug 25, 2016
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2016-6369?

The severity of CVE-2016-6369 is considered high due to its potential to allow local users to gain elevated privileges.

2

How do I fix CVE-2016-6369?

To fix CVE-2016-6369, upgrade your Cisco AnyConnect Secure Mobility Client to version 4.2.05015 or later, or 4.3.02039 or later.

3

What versions are affected by CVE-2016-6369?

CVE-2016-6369 affects multiple versions of Cisco AnyConnect Secure Mobility Client, specifically versions prior to 4.2.05015 and 4.3.x versions before 4.3.02039.

4

What type of vulnerability is CVE-2016-6369?

CVE-2016-6369 is a local privilege escalation vulnerability caused by mishandling pathnames in Cisco AnyConnect Secure Mobility Client.

5

Who is impacted by CVE-2016-6369?

Local users who have access to a vulnerable version of Cisco AnyConnect Secure Mobility Client are impacted by CVE-2016-6369.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203