CVE-2016-6369 — Cisco Anyconnect Secure Mobility Client vulnerability

CWE-2644 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 72.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Anyconnect Secure Mobility Client
Timeline
PublishedAug 25
Latest updateMay 17

Description

Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCuz92464.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-2gmp-cvhp-m5qp: Cisco AnyConnect Secure Mobility Client before 4↗2022-05-17
▶
CVEList
CVE-2016-6369: Cisco AnyConnect Secure Mobility Client before 4↗2016-08-25
▶

📋Vendor Advisories

1
Cisco
Cisco AnyConnect Secure Mobility Client Local Privilege Escalation Vulnerability↗2016-08-24
▶
CVE-2016-6369 — Cisco vulnerability | cvebase