CVE-2023-20178: Incorrect Default Permissions

A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed aft...

CVE-2021-1519: Improper Input Validation

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker...

CVE-2020-3556: Improper Input Validation

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to cause a targeted AnyConnect user to execute a malicious script. The vulnerability is due to a lack of authentication to the IPC listene...

PT-2020-4474

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client Software affected versions not specified Description A vulnerability in the interprocess communication IPC channel could allow an authenticated, local attacker to cause a targeted user to execute a...

CVE-2017-6788: Improper Neutralization of Input During Web Page Generation

The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected software. The vulnerability is due to insufficient input...

PT-2017-16115

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client Software for Windows versions prior to 4.4.00243 and 4.3.05017 Description The issue is due to insufficient implementation of access controls in the Start Before Logon SBL module. An unauthenticated, loc...

CVE-2017-3813: Missing Authorization

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...