Vulnerability · Published May 6, 2021 · Assigned by cisco

CVE-2021-1430Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities

High 7.0

In plain English

A high-severity security flaw in Cisco AnyConnect Secure Mobility Client from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.2%top 85.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco AnyConnect Secure Mobility Client	n/a

Weakness: CWE-378 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

20210505 Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities vendor-advisory, x_refsource_CISCO