CVE-2021-1366

🗓️ 17 Feb 2021 16:55:33Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 501 Views🌐 WEB

Vulnerability in Cisco AnyConnect Secure Mobility Client for Windows (CVE-2021-1366) allows DLL hijacking and arbitrary code execution by authenticated local attacker. Successful exploit could lead to SYSTEM privileges

Reporter	Title	Published	Views	Family All 19
attackerkb	CVE-2021-1366	17 Feb 202116:00	–	attackerkb
GithubExploit	Exploit for Uncontrolled Search Path Element in Cisco Anyconnect_Secure_Mobility_Client	8 Sep 202309:20	–	githubexploit
BDU FSTEC	The vulnerability of the process-interaction channel of the Cisco AnyConnect Secure Mobility Client cryptographic security tool for Windows allows a hacker to execute arbitrary code.	2 Mar 202100:00	–	bdu_fstec
Circl	CVE-2021-1366	17 Feb 202120:49	–	circl
Cisco	Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability	17 Feb 202116:00	–	cisco
Tenable Nessus	Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability (cisco-sa-anyconnect-dll-hijac-JrcTOQMC)	18 Feb 202100:00	–	nessus
CNNVD	Cisco Anyconnect Secure Mobility Client Code Issue Vulnerability	17 Feb 202100:00	–	cnnvd
Core Security	Cisco AnyConnect Posture (HostScan) Security Service Multiple Vulnerabilities	17 Feb 202100:00	–	coresecurity
Core Security	Cisco AnyConnect Posture (HostScan) Security Service CVE-2021-1366 Bypass	16 Jun 202100:00	–	coresecurity
Cvelist	CVE-2021-1366 Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability	17 Feb 202116:55	–	cvelist

NVD

Node

cisco anyconnect_secure_mobility_clientRange<4.9.05042windows

[
  {
    "product": "Cisco AnyConnect Secure Mobility Client",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-hijac-JrcTOQMC

Parameter	Position	Path	Description	CWE
priv_file_copy	request body	C:\Program Files(x86)\Cisco\Cisco HostScan\bin\ciscod.exe	CVE-2021-1366 local privilege escalation via IPC with ciscod.exe; crafted IPC messages (priv_file_copy) can trigger DLL hijacking by loading malicious dbghelp.dll in the HostScan bin.	CWE-347, CWE-427

17 Jun 2026 03:31Current

7.6High risk

Vulners AI Score7.6

CVSS 26.9

CVSS 3.17.8

EPSS0.01253

SSVC