Skip to content
Fencer Vulns
medium 6.5

CVE-2020-3153 kev+ ransomware in the critical feed json

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

published 2020-02-19 6 y ago modified 2026-08-12 2 mo ago also EUVD-2020-24424

cvss
6.5
version 3.0, CNA
cisa kev
Exploited
added 2022-10-24, used in ransomware
epss
28.5%
EPSS 28.5% chance of exploitation in 30 days, percentile 98%
public exploits
1
Metasploit

Summary

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • cisco anyconnect_secure_mobility_client 4.8.02042

Timeline

  1. Published
  2. CISA SSVC: exploitation active
  3. First public exploit (Metasploit exploit/windows/local/anyconnect_lpe)
  4. Added to CISA KEV
  5. CISA patch deadline

Known exploited

Added
4 y ago
Patch by
2022-11-14 (3 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
Cisco, AnyConnect Secure
CISA name
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
partial
Assessed
6 y ago

Exploit prediction

28.52% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/windows/local/anyconnect_lpe Cisco AnyConnect Privilege Escalations (CVE-2020-3153 and CVE-2020-3433) metasploit exploit, excellent rank, 2020-08-05
  • seclists.org http://seclists.org/fulldisclosure/2020/Apr/43 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/157340/Cisco-AnyConnect-Secure-Mobility-Client-4.8.01090-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/158219/Cisco-AnyConnect-Path-Traversal-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
NVD 2.0 4.9 AV:L/AC:L/Au:N/C:N/I:C/A:N

Affected products

  • Cisco Cisco AnyConnect Secure Mobility Client

Classification

Weakness
  • CWE-427 Uncontrolled Search Path Element

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.