CVE-2020-3153
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Published Feb 19, 2020 · updated Aug 11, 2026 · cisco anyconnect secure mobility client
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
Timeline
Detection, updates, and resolution for this record.
Feb 19, 2020 · Catalog
Detected
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a s
Oct 24, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 14, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 11, 2026 · Catalog
Updated
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a s
Required action
Apply updates per vendor instructions.
CISA due date Nov 14, 2022
Affected
- cpe cisco/anyconnect secure mobility clientversion unspecified
- vendor Cisco AnyConnect Secureversion unspecified
Sources
- CISA KEVCVE-2020-3153
Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.
cisa.gov - CVE.orgCVE-2020-3153
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-3153
30-day exploitation probability 28.3%
first.org - Metasploit Modulesexploit_windows/local/anyconnect_lpe
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2020-3153
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling o
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/157340/Cisco-AnyConnect-Secure-Mobility-Client-4.8.01090-Privilege-Escalation.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/158219/Cisco-AnyConnect-Path-Traversal-Privilege-Escalation.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html
Packet Storm link already published on the finding.
packetstormsecurity.com