CVE-2021-1567
Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to a race condition in the signature verification process for DLL files that are loaded on an affected device. An attacker could exploit this vulnerability by sending a series of crafted interprocess communication (IPC) messages to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected device with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid credentials on the Windows system.
Una vulnerabilidad en el mecanismo de carga de DLL de Cisco AnyConnect Secure Mobility Client para Windows, podría permitir a un atacante local autentificado llevar a cabo un ataque de secuestro DLL en un dispositivo afectado si el módulo VPN Posture (HostScan) está instalado en el cliente AnyConnect. Esta vulnerabilidad es debido a una condición de carrera en el proceso de comprobación de la firma de los archivos DLL que son cargados en un dispositivo afectado. Un atacante podría explotar esta vulnerabilidad mediante el envio de una serie de mensajes de comunicación entre procesos (IPC) diseñados al proceso AnyConnect. Una explotación con éxito podría permitir al atacante ejecutar código arbitrario en el dispositivo afectado con privilegios SYSTEM. Para explotar esta vulnerabilidad, el atacante debe tener credenciales válidas en el sistema Windows
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2020-11-13 CVE Reserved
- 2021-06-16 CVE Published
- 2023-03-08 EPSS Updated
- 2024-11-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
- CWE-427: Uncontrolled Search Path Element
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" | < 4.10.01075 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version " < 4.10.01075" | windows |
Affected
|