CVE-2021-34788

CWE-3674 documents4 sources
Severity
7.0HIGH
EPSS
0.0%
top 88.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Anyconnect Secure Mobility ClientCisco Cisco Anyconnect Secure Mobility Client
Timeline
PublishedOct 6
Latest updateMay 24

Description

A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local attacker to perform a shared library hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to a race condition in the signature verification process for shared library files that are loaded on an affected device. An attacker could exploit this vulnerability…

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-mh72-74m7-v766: A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated,↗2022-05-24
▶
CVEList
Cisco AnyConnect Secure Mobility Client for Linux and Mac OS with VPN Posture (HostScan) Module Shared Library Hijacking Vulnerability↗2021-10-06
▶

📋Vendor Advisories

1
Cisco
Cisco AnyConnect Secure Mobility Client for Linux and Mac OS with VPN Posture (HostScan) Module Shared Library Hijacking Vulnerability↗2021-10-06
▶
CVE-2021-34788 (HIGH CVSS 7) | A vulnerability in the shared libra | cvebase.io