Cisco released security updates for Cisco AnyConnect secure mobility client for windows arbitrary code execution vulnerability.
CVE-2021-1366 — Cisco AnyConnect
Cisco AnyConnect Secure Mobility Client empowers remote workers with frictionless, highly secure access to the enterprise network from any device, at any time, in any location while protecting the organization.
Now Cisco has released fix for a vulnerability due to insufficient validation of resources that are loaded by the application at run time.
An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process.
However, a successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges.
In addition, to exploit this vulnerability, the attacker needs valid credentials on the Windows system.
Severity
The vulnerability is considered as HIGH severity with following base metrics:
| Vulnerability Rating | CVSS 3.0 |
| Base Score | 7.2 |
| Base Metrics | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Vulnerability Rating | CVSS 2.0 |
| Base Score | 6.8 |
| Base Metrics | CVSS:2.0/AV:L/AC:L/AU:S/C:C/I:C/A:C |
Affected Products
Cisco AnyConnect Secure Mobility Client for Windows releases earlier than Release 4.9.05042 that have the VPN Posture (HostScan) Module installed.
Follow Us on: Twitter, Instagram, Facebook to get latest security news!
Non-Vulnerable Products
Also, Cisco has confirmed that this vulnerability does not affect the following Cisco products AnyConnect Secure Mobility Client for:
- Linux
- Mac OS
- Mobile device operating systems such as iOS, Android, and Universal Windows Platform
- and, Windows with only the ISE Posture Module installed
Security Fix:
Cisco fixed this vulnerability in Cisco AnyConnect Secure Mobility Client for Windows releases 4.9.05042 and later.
In addition, Customers may only install and expect support for software versions and feature sets for which they have purchased a license.
Leave A Comment