CVE-2020-3433 kev+ ransomware in the critical feed json
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
published 6y ago modified 2mo ago also EUVD-2020-24704
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-10-24, used in ransomware
- epss
- 10.0%
- EPSS 10.0% chance of exploitation in 30 days, percentile 95%
- public exploits
- 1
- Metasploit
Summary
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.
Patch / fix
cisa required action Apply updates per vendor instructions.
- cisco anyconnect_secure_mobility_client 4.9.00086
Is CVE-2020-3433 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- First public exploit (Metasploit exploit/windows/local/anyconnect_lpe)
- CISA SSVC: exploitation active
- Published
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 4y ago
- Patch by
- 2022-11-14 (3y ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Cisco, AnyConnect Secure
- CISA name
- Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 6y ago
Exploit prediction
10.05% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/windows/local/anyconnect_lpe Cisco AnyConnect Privilege Escalations (CVE-2020-3153 and CVE-2020-3433) metasploit exploit, excellent rank, 2020-08-05
- packetstormsecurity.com http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Cisco Cisco AnyConnect Secure Mobility Client
Classification
- Weakness
-
- CWE-427 Uncontrolled Search Path Element
References
-
packetstormsecurity.com
/files/159420/Cisco-AnyConnect-Privilege-Escalation.html
exploit, third-party-advisory, vdb-entry
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3433
government-resource, us-government-resource
Sources
- CVE List CVE-2020-3433
- NVD CVE-2020-3433
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.