medium
5.5
CWE
125
Advisory Published
Updated

CVE-2023-20241

First published: Wed Nov 22 2023(Updated: )

Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system.

Credit: ykramarz@cisco.com

Affected SoftwareAffected VersionHow to fix
Cisco AnyConnect=4.9.00086
Cisco AnyConnect=4.9.01095
Cisco AnyConnect=4.9.02028
Cisco AnyConnect=4.9.03047
Cisco AnyConnect=4.9.03049
Cisco AnyConnect=4.9.04043
Cisco AnyConnect=4.9.04053
Cisco AnyConnect=4.9.05042
Cisco AnyConnect=4.9.06037
Cisco Secure=4.10.00093
Cisco Secure=4.10.01075
Cisco Secure=4.10.02086
Cisco Secure=4.10.03104
Cisco Secure=4.10.04065
Cisco Secure=4.10.04071
Cisco Secure=4.10.05085
Cisco Secure=4.10.05095
Cisco Secure=4.10.05111
Cisco Secure=4.10.06079
Cisco Secure=4.10.06090
Cisco Secure=4.10.07061
Cisco Secure=4.10.07062
Cisco Secure=4.10.07073
Cisco Secure=5.0.00238
Cisco Secure=5.0.00529
Cisco Secure=5.0.00556
Cisco Secure=5.0.01242
Cisco Secure=5.0.02075
Cisco Secure=5.0.03072
Cisco Secure=5.0.03076

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID for these Cisco Secure Client Software vulnerabilities?

    The vulnerability ID for these Cisco Secure Client Software vulnerabilities is CVE-2023-20241.

  • What is the severity of CVE-2023-20241?

    The severity of CVE-2023-20241 is medium, with a severity value of 5.5.

  • What is the impact of the Cisco Secure Client Software vulnerabilities?

    The impact of the Cisco Secure Client Software vulnerabilities is a denial of service (DoS) condition on an affected system.

  • Which versions of Cisco Secure Client Software are affected?

    The affected versions of Cisco Secure Client Software are 4.9.00086, 4.9.01095, 4.9.02028, 4.9.03047, 4.9.03049, 4.9.04043, 4.9.04053, 4.9.05042, 4.9.06037, 4.10.00093, 4.10.01075, 4.10.02086, 4.10.03104, 4.10.04065, 4.10.04071, 4.10.05085, 4.10.05095, 4.10.05111, 4.10.06079, 4.10.06090, 4.10.07061, 4.10.07062, 4.10.07073, 5.0.00238, 5.0.00529, 5.0.00556, 5.0.01242, 5.0.02075, 5.0.03072, and 5.0.03076.

  • How can I fix the Cisco Secure Client Software vulnerabilities?

    To fix the Cisco Secure Client Software vulnerabilities, it is recommended to upgrade to the latest version of the software provided by Cisco.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203