CVE-2015-0761
published 2015-06-04CVE-2015-0761: Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, which…
PriorityP428high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.42%
33.7th percentile
Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, which allows local users to obtain root privileges via crafted vpnagent options, aka Bug ID CSCus86790.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | anyconnect_secure_mobility_client | <= 3.1\(.07021\) | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pxqm-p9p2-q93c: Cisco AnyConnect Secure Mobility Client before 3
ghsa_unreviewed·2022-05-17
CVE-2015-0761 [HIGH] GHSA-pxqm-p9p2-q93c: Cisco AnyConnect Secure Mobility Client before 3
Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, which allows local users to obtain root privileges via crafted vpnagent options, aka Bug ID CSCus86790.
Cisco
Cisco AnyConnect Secure Mobility Client Privilege Escalation Vulnerability
vendor_cisco·2015-06-02·CVSS 7.2
CVE-2015-0761 [HIGH] CWE-264 Cisco AnyConnect Secure Mobility Client Privilege Escalation Vulnerability
Cisco AnyConnect Secure Mobility Client Privilege Escalation Vulnerability
A vulnerability in the code of Cisco AnyConnect Secure Mobility Client for Linux could allow an authenticated, local attacker to elevate privileges to those of the root user.
The vulnerability is due to improper implementation of some internal functions. An attacker could exploit this vulnerability by accessing the system and calling the vpnagent with some options. An exploit could allow the attacker to obtain privileged access to the system.
Cisco has confirmed the vulnerability and released software updates.
To exploit this vulnerability, an attacker must authenticate and have local access to the targeted device. These access requirements decrease the likelihood of a successful exploit.
This vulnerability ca
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2015-06-04
Published