cisco-sa-anyconnect-dll-F26WwJW: Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
First published: Wed Aug 05 2020(Updated: )
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW
Credit: Antoine Goichot PwC Luxembourg's Cybersecurity team
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco AnyConnect Secure Mobility Client |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-anyconnect-dll-F26WwJW?
The severity of cisco-sa-anyconnect-dll-F26WwJW is considered high due to the potential for local authenticated attackers to execute arbitrary code.
How do I fix cisco-sa-anyconnect-dll-F26WwJW?
To fix cisco-sa-anyconnect-dll-F26WwJW, update your Cisco AnyConnect Secure Mobility Client to the latest version recommended by Cisco.
Who is affected by cisco-sa-anyconnect-dll-F26WwJW?
The vulnerability cisco-sa-anyconnect-dll-F26WwJW affects users of the Cisco AnyConnect Secure Mobility Client on Windows operating systems.
What type of attack can cisco-sa-anyconnect-dll-F26WwJW enable?
cisco-sa-anyconnect-dll-F26WwJW can enable a DLL hijacking attack, allowing unauthorized code execution within the context of an already authenticated user.
Are there any workarounds for cisco-sa-anyconnect-dll-F26WwJW?
There are no effective workarounds for cisco-sa-anyconnect-dll-F26WwJW other than promptly updating to the patched version provided by Cisco.
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/event
- agent/type
- agent/title
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco anyconnect secure mobility client