CVE-2020-3433 kev+ ransomware in the critical feed json
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
published 2020-08-17 6 y ago modified 2026-08-12 2 mo ago also EUVD-2020-24704
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-10-24, used in ransomware
- epss
- 10.0%
- EPSS 10.0% chance of exploitation in 30 days, percentile 95%
- public exploits
- 1
- Metasploit
Summary
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.
Patch / fix
cisa required action Apply updates per vendor instructions.
- cisco anyconnect_secure_mobility_client 4.9.00086
Timeline
- First public exploit (Metasploit exploit/windows/local/anyconnect_lpe)
- CISA SSVC: exploitation active
- Published
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 4 y ago
- Patch by
- 2022-11-14 (3 y ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Cisco, AnyConnect Secure
- CISA name
- Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 y ago
Exploit prediction
10.05% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/windows/local/anyconnect_lpe Cisco AnyConnect Privilege Escalations (CVE-2020-3153 and CVE-2020-3433) metasploit exploit, excellent rank, 2020-08-05
- packetstormsecurity.com http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Cisco Cisco AnyConnect Secure Mobility Client
Classification
- Weakness
-
- CWE-427 Uncontrolled Search Path Element
References
-
packetstormsecurity.com
/files/159420/Cisco-AnyConnect-Privilege-Escalation.html
exploit, third-party-advisory, vdb-entry
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3433
government-resource, us-government-resource
Sources
- CVE List CVE-2020-3433
- NVD CVE-2020-3433
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.