Cisco Releases Security Advisory for CVE-2020-2556

Threat ID:: CC-3693
Threat Severity:: Information only
Published:: 8 December 2020 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 4.9.04053 (if BypassDownloader is set to default value false), 4.9.04053 and later (if RestrictScriptWebDeploy is set to default value false)

Cisco AnyConnect Secure Mobility Client

Threat details

Introduction

Cisco has released a security advisory on an arbitrary code execution vulnerability affecting Cisco AnyConnect Secure Mobility Client software. A remote attacker could exploit this vulnerability to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review Cisco security advisory cisco-sa-anyconnect-ipc-KfQO9QhK and apply the relevant updates.

CVE Vulnerabilities

Status Master

CVE-2020-3556

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to cause a targeted AnyConnect user to execute a malicious script. The vulnerability is due to a lack of authentication to the IPC listener. An attacker could exploit this vulnerability by sending crafted IPC messages to the AnyConnect client IPC listener. A successful exploit could allow an attacker to cause the targeted AnyConnect user to execute a script. This script would execute with the privileges of the targeted AnyConnect user. In order to successfully exploit this vulnerability, there must be an ongoing AnyConnect session by the targeted user at the time of the attack. To exploit this vulnerability, the attacker would also need valid user credentials on the system upon which the AnyConnect client is being run. Cisco has not released software updates that address this vulnerability.

Last edited: 8 December 2020 1:30 pm