Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability

published 2021-06-16 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-7034

cvss: 7.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits: 0; none known

A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to a race condition in the signature verification process for DLL files that are loaded on an affected device. An attacker could exploit this vulnerability by sending a series of crafted interprocess communication (IPC) messages to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected device with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid credentials on the Windows system.

Patch / fix

fixed in 1

cisco anyconnect_secure_mobility_client 4.10.01075

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-11-07)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	6.7	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.2	AV:L/AC:H/Au:N/C:C/I:C/A:C

Affected products

Cisco Cisco AnyConnect Secure Mobility Client

Classification

Weakness

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-427 Uncontrolled Search Path Element

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-pos-dll-ff8j6dFv
vendor-advisory

Sources

CVE List CVE-2021-1567
NVD CVE-2021-1567

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary