CVE-2021-1366

🗓️ 17 Feb 2021 16:55:33Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 480 Views🌐 WEB

Vulnerability in Cisco AnyConnect Secure Mobility Client for Windows (CVE-2021-1366) allows DLL hijacking and arbitrary code execution by authenticated local attacker. Successful exploit could lead to SYSTEM privileges

Reporter	Title	Published	Views	Family All 16
GithubExploit	Exploit for Uncontrolled Search Path Element in Cisco Anyconnect_Secure_Mobility_Client	8 Sep 202309:20	–	githubexploit
BDU FSTEC	The vulnerability of the process-interaction channel of the Cisco AnyConnect Secure Mobility Client cryptographic security tool for Windows allows a hacker to execute arbitrary code.	2 Mar 202100:00	–	bdu_fstec
Circl	CVE-2021-1366	17 Feb 202120:49	–	circl
Cisco	Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability	17 Feb 202116:00	–	cisco
Tenable Nessus	Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability (cisco-sa-anyconnect-dll-hijac-JrcTOQMC)	18 Feb 202100:00	–	nessus
CNNVD	Cisco Anyconnect Secure Mobility Client Code Issue Vulnerability	17 Feb 202100:00	–	cnnvd
Core Security	Cisco AnyConnect Posture (HostScan) Security Service Multiple Vulnerabilities	17 Feb 202100:00	–	coresecurity
Core Security	Cisco AnyConnect Posture (HostScan) Security Service CVE-2021-1366 Bypass	16 Jun 202100:00	–	coresecurity
Cvelist	CVE-2021-1366 Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability	17 Feb 202116:55	–	cvelist
EUVD	EUVD-2021-6833	3 Oct 202520:07	–	euvd

NVD

Node

cisco anyconnect_secure_mobility_clientRange<4.9.05042windows

[
  {
    "product": "Cisco AnyConnect Secure Mobility Client",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-hijac-JrcTOQMC

Parameter	Position	Path	Description	CWE
priv_file_copy	path	C:\Program Files(x86)\Cisco\Cisco HostScan\bin\ciscod.exe	DLL hijacking via IPC (priv_file_copy) to ciscod.exe to drop malicious DLLs for DLL proxying during service restart	CWE-347, CWE-427
dbghelp.dll	path	C:\Program Files(x86)\Cisco\Cisco HostScan\bin\ciscod.exe	DLL hijacking via IPC (priv_file_copy) to ciscod.exe to drop malicious DLLs for DLL proxying during service restart	CWE-347, CWE-427
dbghelp_orig.dll	path	C:\Program Files(x86)\Cisco\Cisco HostScan\bin\ciscod.exe	DLL hijacking via IPC (priv_file_copy) to ciscod.exe to drop malicious DLLs for DLL proxying during service restart	CWE-347, CWE-427

17 Jun 2026 03:31Current

7.6High risk

Vulners AI Score7.6

CVSS 26.9

CVSS 3.17.8

EPSS0.01253

SSVC