CVE-2019-16007: Cisco AnyConnect Secure Mobility Client for Android Service Hijack Vulnerability
A vulnerability in the inter-service communication of Cisco AnyConnect Secure Mobility Client for Android could allow an unauthenticated, local attacker to perform a service hijack attack on an affected device or cause a denial of service (DoS) condition. The vulnerability is due to the use of implicit service invocations. An attacker could exploit this vulnerability by persuading a user to install a malicious application. A successful exploit could allow the attacker to access confidential user information or cause a DoS condition on the AnyConnect application.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-16007?
CVE-2019-16007 is a vulnerability in the inter-service communication of Cisco AnyConnect Secure Mobility Client for Android that could allow an unauthenticated, local attacker to perform a service hijack attack or cause a denial of service (DoS) condition.
What is the severity of CVE-2019-16007?
CVE-2019-16007 has a severity rating of 7.1 (high).
How does CVE-2019-16007 affect Cisco AnyConnect Secure Mobility Client?
CVE-2019-16007 affects Cisco AnyConnect Secure Mobility Client for Android versions up to and excluding 4.8.00826.
How can an attacker exploit CVE-2019-16007?
An unauthenticated, local attacker can exploit CVE-2019-16007 to perform a service hijack attack or cause denial of service by manipulating inter-service communication.
What is the fix for CVE-2019-16007?
To fix CVE-2019-16007, users should upgrade to a version of Cisco AnyConnect Secure Mobility Client for Android that is equal to or higher than 4.8.00826.