The vulnerability of the Cisco Secure Client (formerly Cisco AnyConnect Secure Mobility Client) endpoint security mechanism lies in the lack of measures to neutralize CRLF sequences, allowing attackers to execute arbitrary code in the browser.

The vulnerability of the Cisco Secure Client formerly Cisco AnyConnect Secure Mobility Client security mechanism is related to the failure to handle CRLF sequences properly. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the browser, provided that the user...

Cisco Releases Security Updates for Secure Client

Cisco released security updates to address vulnerabilities in Cisco Secure Client and Secure Client for Linux. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected device. CISA encourages users and administrators to review the following security releases...

Vulnerability fixed in Cisco Secure Client

Cisco has fixed a vulnerability in the Secure Client. A malicious party could exploit the vulnerability to use a malicious link to gain access to the SAML token of the victim and thus establish a VPN connection. Access to underlying systems and applications still require authentication. Cisco has...

CVE-2024-20338

A vulnerability in the ISE Posture System Scan module of Cisco Secure Client for Linux could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to the use of an uncontrolled search path element. An attacker could exploit this vulnerabilit...

Code injection

A vulnerability in the ISE Posture System Scan module of Cisco Secure Client for Linux could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to the use of an uncontrolled search path element. An attacker could exploit this vulnerabilit...

Crlf injection

A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed CRLF injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could...

CVE-2024-20337

A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed CRLF injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could...

CVE-2024-20337

A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed CRLF injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could...

CVE-2024-20338

A vulnerability in the ISE Posture System Scan module of Cisco Secure Client for Linux could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to the use of an uncontrolled search path element. An attacker could exploit this vulnerabilit...

CVE-2024-20338

Cisco Secure Client for Linux contains a privilege-escalation flaw in the ISE Posture (System Scan) module caused by an uncontrolled search path element. An authenticated, local attacker could place a malicious library in a targeted filesystem location and, after prompting an admin to restart a p...

CVE-2024-20338

A vulnerability in the ISE Posture System Scan module of Cisco Secure Client for Linux could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to the use of an uncontrolled search path element. An attacker could exploit this vulnerabilit...

Cisco Secure Client Security Vulnerability

Cisco Secure Client is a piece of software from Cisco that is used to connect to virtual private networks. A security vulnerability exists in Cisco Secure Client that stems from insufficient validation of user-supplied input. It could allow an unauthenticated remote attacker to perform a Carriage...

PT-2024-2032 · Cisco · Cisco Secure Client

Name of the Vulnerable Software and Affected Versions: Cisco Secure Client versions affected versions not specified Description: The issue is related to an uncontrolled search path element in the ISE Posture System Scan module. This could allow an authenticated, local attacker to elevate privileg...

Cisco Secure Client Security Vulnerability

Cisco Secure Client is a software from Cisco that is used to connect to virtual private networks. A security vulnerability exists in Cisco Secure Client, which stems from a vulnerability in the ISE Posture System Scan module that could allow an authenticated, local attacker to elevate privileges ...

PT-2024-2007 · Cisco · Cisco Secure Client

Name of the Vulnerable Software and Affected Versions: Cisco Secure Client affected versions not specified Description: A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed CRLF injection...

Cisco Secure Client Software DoS (cisco-sa-accsc-dos-9SLzkZ8) (CVE-2023-20241)

According to its self-reported version, Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client is affected by multiple denial of service DoS vulnerabilities. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploi...

The vulnerability of the Cisco Secure Client (formerly Cisco AnyConnect Secure Mobility Client) endpoint security mechanism, related to improper cleaning or release of resources, allows a perpetrator to trigger a service failure.

The vulnerability of the Cisco Secure Client formerly Cisco AnyConnect Secure Mobility Client endpoint security mechanism is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a attacker to cause service failures...

The vulnerability of the Cisco Secure Client (formerly Cisco AnyConnect Secure Mobility Client) endpoint security mechanism, related to improper cleaning or release of resources, allows a perpetrator to trigger a service failure.

The vulnerability of the Cisco Secure Client formerly Cisco AnyConnect Secure Mobility Client endpoint security mechanism is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a attacker to cause service failures...

CVE-2023-20240

Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Clie...

CVE-2023-20240

Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Clie...