Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability

Cisco AnyConnect Secure Mobility Client contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system.

The vulnerability is due to insufficient validation of user-supplied input that is received by the 64-bit Java applet that performs the WebLaunch VPN downloader functionality in the affected software. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious website. If successful, the attacker could have the ability to execute arbitrary code with the privileges of the user on the affected system.

Cisco has confirmed this vulnerability in a security advisory and software updates are available.

To exploit the vulnerability, the attacker may provide a link that directs a user to a malicious site and use misleading language or instructions to persuade the user to follow the provided link.

This alert contains CVSS scoring supplied by Cisco, the primary vendor of the affected product. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.