CVE-2021-1450: Input Validation
First published: Wed Feb 24 2021(Updated: )
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. To exploit this vulnerability, the attacker would need to have valid credentials on the device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending one or more crafted IPC messages to the AnyConnect process on an affected device. A successful exploit could allow the attacker to stop the AnyConnect process, causing a DoS condition on the device. Note: The process under attack will automatically restart so no action is needed by the user or admin.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Anyconnect Secure Mobility Client | =4.9\(5086\) | |
| Apple macOS | ||
| Linux Linux kernel | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-1450?
CVE-2021-1450 is a vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client that could allow a local attacker to cause a denial of service (DoS) condition on an affected device.
How does CVE-2021-1450 affect Cisco AnyConnect Secure Mobility Client?
CVE-2021-1450 affects Cisco AnyConnect Secure Mobility Client by allowing an attacker with valid credentials to exploit the vulnerability and cause a denial of service (DoS) condition on the device.
What is the severity of CVE-2021-1450?
CVE-2021-1450 has a severity rating of 5.5, which is considered medium.
Is Apple macOS affected by CVE-2021-1450?
No, Apple macOS is not affected by CVE-2021-1450.
Is Linux Linux kernel affected by CVE-2021-1450?
No, Linux Linux kernel is not affected by CVE-2021-1450.
Is Microsoft Windows affected by CVE-2021-1450?
No, Microsoft Windows is not affected by CVE-2021-1450.
How can CVE-2021-1450 be fixed?
To fix CVE-2021-1450, Cisco AnyConnect Secure Mobility Client should be updated to the latest version provided by Cisco.
- collector/nvd-index
- vendor/cisco
- canonical/cisco anyconnect secure mobility client
- version/cisco anyconnect secure mobility client/4.9\(5086\)
- vendor/apple
- canonical/apple macos
- vendor/linux
- canonical/linux linux kernel
- vendor/microsoft
- canonical/microsoft windows