CVE-2021-1366

🗓️ 17 Feb 2021 16:55:33Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 466 Views🌐 WEB

Vulnerability in Cisco AnyConnect Secure Mobility Client for Windows (CVE-2021-1366) allows DLL hijacking and arbitrary code execution by authenticated local attacker. Successful exploit could lead to SYSTEM privileges

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for Uncontrolled Search Path Element in Cisco Anyconnect_Secure_Mobility_Client	8 Sep 202309:20	–	githubexploit
Circl	CVE-2021-1366	17 Feb 202120:49	–	circl
Cisco	Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability	17 Feb 202116:00	–	cisco
Tenable Nessus	Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability (cisco-sa-anyconnect-dll-hijac-JrcTOQMC)	18 Feb 202100:00	–	nessus
CNNVD	Cisco Anyconnect Secure Mobility Client Code Issue Vulnerability	17 Feb 202100:00	–	cnnvd
Core Security	Cisco AnyConnect Posture (HostScan) Security Service Multiple Vulnerabilities	17 Feb 202100:00	–	coresecurity
Core Security	Cisco AnyConnect Posture (HostScan) Security Service CVE-2021-1366 Bypass	16 Jun 202100:00	–	coresecurity
Cvelist	CVE-2021-1366 Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability	17 Feb 202116:55	–	cvelist
EUVD	EUVD-2021-6833	3 Oct 202520:07	–	euvd
NCSC	Vulnerability fixed in Cisco Anyconnect Client	18 Feb 202100:00	–	ncsc

NVD

Node

cisco anyconnect_secure_mobility_clientRange<4.9.05042windows

[
  {
    "product": "Cisco AnyConnect Secure Mobility Client",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-hijac-JrcTOQMC

Parameter	Position	Path	Description	CWE
priv_file_copy	path	C:\Program Files(x86)\Cisco\Cisco HostScan\bin\ciscod.exe	DLL hijacking via IPC with Privilege Escalation attempting to copy malicious DLLs into Cisco HostScan bin and load on restart	CWE-427, CWE-347

21 Nov 2024 05:44Current

7.6High risk

Vulners AI Score7.6

CVSS 26.9

CVSS 3.17.8

EPSS0.00645

SSVC