Cisco Zero-Day in AnyConnect Secure Mobility Client Remains Unpatched

🗓️ 05 Nov 2020 15:16:26Reported by Lindsey O'DonnellType

Cisco discloses unpatched zero-day in AnyConnect Secure Mobility Client for Windows, macOS, and Linux with high-severity CVE-2020-3556. Exploiting the vulnerability requires valid user credentials

Reporter	Title	Published	Views	Family All 96
BDU FSTEC	The vulnerability of the IPC channel implementation in the Cisco AnyConnect Secure Mobility Client cryptographic security tool allows a perpetrator to execute arbitrary code.	10 Nov 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Webex Meetings Desktop App’s software lies in the incorrect path name limitation, which allows a malicious actor to execute arbitrary code.	17 Nov 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Webex Network Recording Player and Cisco Webex Player for Windows operating systems arises from the operation beyond buffer boundaries in memory, allowing an attacker to execute arbitrary code.	17 Nov 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Webex Network Recording Player and Cisco Webex Player for Windows operating systems arises from the operation beyond buffer boundaries in memory, allowing an attacker to execute arbitrary code.	17 Nov 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the command-line interface (CLI) of the programmatically defined Cisco SD-WAN network allows a attacker to trigger a service failure.	17 Nov 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the TCP packet processing function in Cisco IP Phone microprogramming software allows a hacker to trigger a service failure.	17 Nov 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the transmission function for programmatically defined system files in Cisco SD-WAN allows a perpetrator to enhance their privileges and gain access to modify, add, or delete data.	18 Nov 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Webex Network Recording Player and Cisco Webex Player for Windows operating systems arises from the operation beyond buffer boundaries in memory, allowing an attacker to execute arbitrary code.	18 Nov 202000:00	–	bdu_fstec
Circl	CVE-2020-26071	25 Sep 202500:36	–	circl
Circl	CVE-2020-26074	18 Nov 202416:00	–	circl

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-ipc-KfQO9QhK
threatpost	www.threatpost.com/newsletter-sign/
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-vdi-qQrpBwuJ
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-nbr-NOS6FQ24
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vsoln-arbfile-gtsEYxns
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-escalation-Jhqs5Skf
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phone-flood-dos-YnU9EXOv
threatpost	www.threatpost.com/webinars/2020-healthcare-cybersecurity-priorities-data-security-ransomware-and-patching/
threatpost	www.threatpost.com/webinars/2020-healthcare-cybersecurity-priorities-data-security-ransomware-and-patching/
threatpost	www.threatpost.com/webinars/2020-healthcare-cybersecurity-priorities-data-security-ransomware-and-patching/