Cisco AnyConnect Secure Mobility Client CVE-2019-16007 Remote Security Bypass Vulnerability

Description

Cisco AnyConnect Secure Mobility Client is prone to a remote security-bypass vulnerability. An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCvr67149.

Technologies Affected

• Cisco AnyConnect Secure Mobility Client 2
• Cisco AnyConnect Secure Mobility Client 2.0.0343
• Cisco AnyConnect Secure Mobility Client 2.1
• Cisco AnyConnect Secure Mobility Client 2.1.0148
• Cisco AnyConnect Secure Mobility Client 2.2
• Cisco AnyConnect Secure Mobility Client 2.2.0133
• Cisco AnyConnect Secure Mobility Client 2.2.0136
• Cisco AnyConnect Secure Mobility Client 2.2.0140
• Cisco AnyConnect Secure Mobility Client 2.2.128
• Cisco AnyConnect Secure Mobility Client 2.2.133
• Cisco AnyConnect Secure Mobility Client 2.2.136
• Cisco AnyConnect Secure Mobility Client 2.2.140
• Cisco AnyConnect Secure Mobility Client 2.3
• Cisco AnyConnect Secure Mobility Client 2.3.0185
• Cisco AnyConnect Secure Mobility Client 2.3.0254
• Cisco AnyConnect Secure Mobility Client 2.3.1003
• Cisco AnyConnect Secure Mobility Client 2.3.185
• Cisco AnyConnect Secure Mobility Client 2.3.2016
• Cisco AnyConnect Secure Mobility Client 2.3.254
• Cisco AnyConnect Secure Mobility Client 2.4
• Cisco AnyConnect Secure Mobility Client 2.4.0202
• Cisco AnyConnect Secure Mobility Client 2.4.1012
• Cisco AnyConnect Secure Mobility Client 2.4.4004
• Cisco AnyConnect Secure Mobility Client 2.4.4014
• Cisco AnyConnect Secure Mobility Client 2.4.5004
• Cisco AnyConnect Secure Mobility Client 2.4.7030
• Cisco AnyConnect Secure Mobility Client 2.4.7073
• Cisco AnyConnect Secure Mobility Client 2.5
• Cisco AnyConnect Secure Mobility Client 2.5 MR6
• Cisco AnyConnect Secure Mobility Client 2.5.0
• Cisco AnyConnect Secure Mobility Client 2.5.0217
• Cisco AnyConnect Secure Mobility Client 2.5.1025
• Cisco AnyConnect Secure Mobility Client 2.5.2001
• Cisco AnyConnect Secure Mobility Client 2.5.2006
• Cisco AnyConnect Secure Mobility Client 2.5.2010
• Cisco AnyConnect Secure Mobility Client 2.5.2011
• Cisco AnyConnect Secure Mobility Client 2.5.2014
• Cisco AnyConnect Secure Mobility Client 2.5.2017
• Cisco AnyConnect Secure Mobility Client 2.5.2018
• Cisco AnyConnect Secure Mobility Client 2.5.2019
• Cisco AnyConnect Secure Mobility Client 2.5.3041
• Cisco AnyConnect Secure Mobility Client 2.5.3046
• Cisco AnyConnect Secure Mobility Client 2.5.3051
• Cisco AnyConnect Secure Mobility Client 2.5.3054
• Cisco AnyConnect Secure Mobility Client 2.5.3055
• Cisco AnyConnect Secure Mobility Client 2.5.5112
• Cisco AnyConnect Secure Mobility Client 2.5.5116
• Cisco AnyConnect Secure Mobility Client 2.5.5118
• Cisco AnyConnect Secure Mobility Client 2.5.5125
• Cisco AnyConnect Secure Mobility Client 2.5.5130
• Cisco AnyConnect Secure Mobility Client 2.5.5131
• Cisco AnyConnect Secure Mobility Client 2.5.6005
• Cisco AnyConnect Secure Mobility Client 3
• Cisco AnyConnect Secure Mobility Client 3.0
• Cisco AnyConnect Secure Mobility Client 3.0 MR8
• Cisco AnyConnect Secure Mobility Client 3.0.0
• Cisco AnyConnect Secure Mobility Client 3.0.0629
• Cisco AnyConnect Secure Mobility Client 3.0.07059
• Cisco AnyConnect Secure Mobility Client 3.0.08057
• Cisco AnyConnect Secure Mobility Client 3.0.08066
• Cisco AnyConnect Secure Mobility Client 3.0.09231
• Cisco AnyConnect Secure Mobility Client 3.0.09266
• Cisco AnyConnect Secure Mobility Client 3.0.09353
• Cisco AnyConnect Secure Mobility Client 3.0.1047
• Cisco AnyConnect Secure Mobility Client 3.0.2052
• Cisco AnyConnect Secure Mobility Client 3.0.3050
• Cisco AnyConnect Secure Mobility Client 3.0.3054
• Cisco AnyConnect Secure Mobility Client 3.0.4235
• Cisco AnyConnect Secure Mobility Client 3.0.5075
• Cisco AnyConnect Secure Mobility Client 3.0.5080
• Cisco AnyConnect Secure Mobility Client 3.0.629
• Cisco AnyConnect Secure Mobility Client 3.1
• Cisco AnyConnect Secure Mobility Client 3.1(.02043)
• Cisco AnyConnect Secure Mobility Client 3.1(60)
• Cisco AnyConnect Secure Mobility Client 3.1.0
• Cisco AnyConnect Secure Mobility Client 3.1.00495
• Cisco AnyConnect Secure Mobility Client 3.1.02043
• Cisco AnyConnect Secure Mobility Client 3.1.05182
• Cisco AnyConnect Secure Mobility Client 3.1.05187
• Cisco AnyConnect Secure Mobility Client 3.1.06073
• Cisco AnyConnect Secure Mobility Client 3.1.07021
• Cisco AnyConnect Secure Mobility Client 3.1.14018
• Cisco AnyConnect Secure Mobility Client 3.2.0
• Cisco AnyConnect Secure Mobility Client 4.0 (2049)
• Cisco AnyConnect Secure Mobility Client 4.0 (48)
• Cisco AnyConnect Secure Mobility Client 4.0 (64)
• Cisco AnyConnect Secure Mobility Client 4.0
• Cisco AnyConnect Secure Mobility Client 4.0(2049)
• Cisco AnyConnect Secure Mobility Client 4.0(61)
• Cisco AnyConnect Secure Mobility Client 4.0.0
• Cisco AnyConnect Secure Mobility Client 4.0.00048
• Cisco AnyConnect Secure Mobility Client 4.0.00051
• Cisco AnyConnect Secure Mobility Client 4.1 (8)
• Cisco AnyConnect Secure Mobility Client 4.1.0
• Cisco AnyConnect Secure Mobility Client 4.2
• Cisco AnyConnect Secure Mobility Client 4.3
• Cisco AnyConnect Secure Mobility Client 4.3(5017)
• Cisco AnyConnect Secure Mobility Client 4.3(754)
• Cisco AnyConnect Secure Mobility Client 4.3.01095
• Cisco AnyConnect Secure Mobility Client 4.3.02039
• Cisco AnyConnect Secure Mobility Client 4.3.03086
• Cisco AnyConnect Secure Mobility Client 4.3.04027
• Cisco AnyConnect Secure Mobility Client 4.3.05017
• Cisco AnyConnect Secure Mobility Client 4.4
• Cisco AnyConnect Secure Mobility Client 4.4(1009)
• Cisco AnyConnect Secure Mobility Client 4.4(243)
• Cisco AnyConnect Secure Mobility Client 4.4(4030)
• Cisco AnyConnect Secure Mobility Client 4.4.00243
• Cisco AnyConnect Secure Mobility Client 4.4.01054
• Cisco AnyConnect Secure Mobility Client 4.4.02034
• Cisco AnyConnect Secure Mobility Client 4.5
• Cisco AnyConnect Secure Mobility Client 4.6
• Cisco AnyConnect Secure Mobility Client 4.6(2074)
• Cisco AnyConnect Secure Mobility Client 4.7.0

Recommendations

Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.
Ensure that only trusted users have local, interactive access to affected computers.

Run all software as a nonprivileged user with minimal access rights.
To limit the potential damage that successful exploits may achieve, run all nonadministrative software as an unprivileged user.

Updates are available. Please see the references or vendor advisory for more information.