CVE-2023-20178

CVE-2023-20178 これは、Cisco Secure Client（バージョン5.0.01242でテスト済み）およびCisco AnyConnect（バージョン4.10.06079でテスト済み）における任意ファイル削除の脆弱性のPoCです。 ユーザーがVPNに接続すると、vpndownloader.exeプロセスがバックグラウンドで起動し、c:\windows\temp に以下の形式でデフォルト権限のディレクトリを作成します： .tmp...

PT-2022-6663 · Cisco · Cisco Secure Client

Name of the Vulnerable Software and Affected Versions: Cisco Secure Client formerly Cisco AnyConnect Secure Mobility Client versions affected versions not specified Description: A vulnerability in the client update process of Cisco Secure Client Software for Windows could allow a low-privileged,...

Cisco AnyConnect Path Traversal / Privilege Escalation Exploit

The installer component of Cisco AnyConnect Secure Mobility Client for Windows prior to version 4.8.02042 is vulnerable to path traversal and allows local attackers to create/overwrite files in arbitrary locations with system level privileges. The attack consists in sending a specially crafted IP...

Cisco AnyConnect Secure Mobility Client 4.8.01090 Privilege Escalation Vulnerability

Cisco AnyConnect Secure Mobility Client for Windows version 4.8.01090 suffer from a privilege escalation vulnerability due to insecure handling of path names. ------------------------------------------------------------------------ Cisco AnyConnect elevation of privileges due to insecure handling...