CVE-2020-3433

published 2020-08-17

CVE-2020-3433: A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local…

Priority P1 82 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

KEV ITW EXPLOIT Ransomware

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	anyconnect_secure_mobility	—	—
cisco	anyconnect_secure_mobility_client	< 4.9.00086	4.9.00086
cisco	cisco_anyconnect_secure_mobility_client	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 62522↗

filename dbghelp.dll↗

process vpndownloader↗

• → Monitor for crafted IPC messages sent to the AnyConnect process over TCP port 62522 on the loopback interface, which is the attack vector used to trigger the vulnerable installer component. ↗
• → Alert on creation of dbghelp.dll in unexpected or non-standard directories, particularly in locations where vpndownloader is copied at runtime, as this is the DLL hijacking payload. ↗
• → Monitor vpndownloader process spawning from unexpected parent processes or executing from non-standard paths, as exploitation causes the service to launch vpndownloader with SYSTEM privileges. ↗
• → Check Point IPS signature available for detection: 'Cisco AnyConnect Secure Mobility Client Privilege Escalation (CVE-2020-3153)' — also applicable to CVE-2020-3433 exploitation chain. ↗

• · Exploitation requires the attacker to already have valid credentials on the Windows system; this is a local privilege escalation, not a remote unauthenticated attack. ↗
• · CVE-2020-3433 affects Cisco AnyConnect Secure Mobility Client for Windows prior to version 4.9.00086; versions 4.5.02036, 4.6.03049, 4.7.04056, 4.8.01090, and 4.8.03052 were confirmed vulnerable in testing. ↗
• · The vulnerability is in the IPC channel's insufficient validation of resources loaded at run time; the attack surface is the loopback TCP port 62522 exposed by the Cisco AnyConnect Secure Mobility Agent service. ↗

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.2 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C

vulncheck 7.8 HIGH

cisa 7.8 HIGH

vendor_cisco 7.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-427