AEGLIX vulnerability intelligence
CVE-2020-3433
HIGH · CVSS 7.8 · Analyzed
Published: 2020-08-17 · Updated: 2026-08-12 · Source: NVD
Vulnerability overview
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.
Severity and scoring
- CVSS score
- 7.8 · HIGH
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-427
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Cisco · AnyConnect Secure
- Added to catalog
- 2022-10-24
- Required action
- Apply updates per vendor instructions.
- CISA remediation due date
- 2022-11-14
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:windows:*:*
Before (exclusive): 4.9.00086
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html
Exploit · Third Party Advisory · VDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW
Vendor Advisory
- http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html
Exploit · Third Party Advisory · VDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW
Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3433
US Government Resource