AS
Product
Anyconnect Secure Mobility Client
On CISA KEVExploited in the wildRansomware-linked
69
CVEs
2
On KEV
7.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 19Medium 19Low 0
Watch
Add Anyconnect Secure Mobility Client to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-3433 RansomwareIn wildKEV | 7.8 | Aug 17 | Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability Affected: before 4.9.00086 |
| CVE-2020-3153 RansomwareIn wildKEV | 6.5 | Feb 19 | Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability Affected: before 4.8.02042 |
| CVE-2023-20178 | 7.8 | Jun 28 | A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a… Affected: before 4.10.07061 |
| CVE-2021-40124 | 7.8 | Nov 4 | A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to escalate… Affected: before 4.10.03104 |
| CVE-2021-1496 | 7.8 | May 6 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to… Affected: before 4.9.03022 |
| CVE-2021-1430 | 7.8 | May 6 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to… Affected: before 4.9.06037 |
| CVE-2021-1429 | 7.8 | May 6 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to… Affected: before 4.10.00093 |
| CVE-2021-1428 | 7.8 | May 6 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to… Affected: before 4.10.00093 |
| CVE-2021-1427 | 7.8 | May 6 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to… Affected: before 4.9.06037 |
| CVE-2021-1426 | 7.8 | May 6 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to… Affected: before 4.9.06037 |
| CVE-2021-1366 | 7.8 | Feb 17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a… Affected: before 4.9.05042 |
| CVE-2021-1237 | 7.8 | Jan 13 | A vulnerability in the Network Access Manager and Web Security Agent components of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker… Affected: before 4.9.04043 |
| CVE-2017-6638 | 7.8 | Jun 8 | A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and run an executable… Affected: through 4.4.00243 |
| CVE-2017-3813 | 7.8 | Feb 9 | A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open… Affected: 4.0.00048; 4.0.00051; 4.0.00052; 4.0.00057; 4.0.00061; 4.1.00028; +19 more |
| CVE-2016-9192 | 7.8 | Dec 14 | A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with… Affected: 3.1(60); 3.1.0; 3.1.02043; 3.1.05182; 3.1.05187; 3.1.06073; +14 more |
| CVE-2016-6369 | 7.8 | Aug 25 | Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka… Affected: 2.0.0343; 2.1.0148; 2.2.0133; 2.2.0136; 2.2.0140; 2.3.0185; +34 more |
| CVE-2019-1853 | 7.5 | May 16 | A vulnerability in the HostScan component of Cisco AnyConnect Secure Mobility Client for Linux could allow an unauthenticated, remote attacker to read sensitive information on an… Affected: 4.6(2074) |
| CVE-2020-3556 | 7.3 | Nov 6 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to cause a… Affected: 4.9(3052); 98.145(86) |
| CVE-2019-16007 | 7.1 | Sep 23 | A vulnerability in the inter-service communication of Cisco AnyConnect Secure Mobility Client for Android could allow an unauthenticated, local attacker to perform a service… Affected: before 4.8.00826 |
| CVE-2021-34788 | 7.0 | Oct 6 | A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local attacker to perform a… Affected: before 4.10.03104 |
| CVE-2021-1567 | 6.7 | Jun 16 | A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack… Affected: before 4.10.01075 |
| CVE-2024-20474 | 6.5 | Oct 23 | A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service… Affected: 4.9.00086; 4.9.01095; 4.9.02028; 4.9.03047; 4.9.03049; 4.9.04043; +3 more |
| CVE-2018-0229 | 6.5 | Apr 19 | A vulnerability in the implementation of Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication for Cisco AnyConnect Secure Mobility Client for Desktop… Affected: 4.6(200) |
| CVE-2017-12268 | 6.5 | Oct 5 | A vulnerability in the Network Access Manager (NAM) of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters,… Affected: 4.5(822) |
| CVE-2017-6788 | 6.1 | Aug 17 | The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a… Affected: 4.4(4027); 4.5(58) |
| CVE-2020-3432 | 5.6 | Feb 12 | A vulnerability in the uninstaller component of Cisco AnyConnect Secure Mobility Client for Mac OS could allow an authenticated, local attacker to corrupt the content of any file… Affected: before 4.9.00086 |
| CVE-2023-20241 | 5.5 | Nov 22 | Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service… Affected: 4.9.00086; 4.9.01095; 4.9.02028; 4.9.03047; 4.9.03049; 4.9.04043; +3 more |
| CVE-2023-20240 | 5.5 | Nov 22 | Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service… Affected: 4.9.00086; 4.9.01095; 4.9.02028; 4.9.03047; 4.9.03049; 4.9.04043; +3 more |
| CVE-2021-1568 | 5.5 | Jun 16 | A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected… Affected: before 4.10.01075 |
| CVE-2021-1519 | 5.5 | May 6 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN… Affected: before 4.10.00093 |
| CVE-2021-1450 | 5.5 | Feb 24 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to cause a denial of… Affected: 4.9(5086) |
| CVE-2021-1258 | 5.5 | Jan 13 | A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read arbitrary files on the… Affected: before 4.9.03047; before 4.9.03047; before 4.9.03049 |
| CVE-2020-27123 | 5.5 | Nov 6 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read… Affected: before 4.9.03047 |
| CVE-2020-3435 | 5.5 | Aug 17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to overwrite… Affected: through 4.9.00086 |
| CVE-2020-3434 | 5.5 | Aug 17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a… Affected: through 4.9.00086 |
| CVE-2018-0373 | 5.5 | Jun 21 | A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated,… Affected: 4.5(58); 4.5(1044); 4.5(2033); 4.5(2036); 4.5(3040); 4.5(4029); +3 more |
| CVE-2018-0334 | 4.8 | Jun 7 | A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android,… Affected: 4.6(100) |
| CVE-2018-0100 | 4.4 | Jan 18 | A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information… Affected: All versions, or not specified |
| CVE-2015-6322 | – | Oct 12 | The IPC channel in Cisco AnyConnect Secure Mobility Client 2.0.0343 through 4.1(8) allows local users to bypass intended access restrictions and move arbitrary files by leveraging… Affected: 2.0.0343; 2.1.0148; 2.2.0133; 2.2.0136; 2.2.0140; 2.3.0185; +34 more |
| CVE-2015-6306 | – | Sep 26 | Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a… Affected: 4.1.(8) |
| CVE-2015-6305 | – | Sep 26 | Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility Client 2.0 through 4.1 on Windows allows… Affected: 2.0.0343; 2.1.0.148; 2.2.0133; 2.2.0136; 2.2.0140; 2.3.0185; +34 more |
| CVE-2015-4289 | – | Aug 1 | Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.0(2049) allows remote head-end systems to write to arbitrary files via a crafted configuration… Affected: 4.0(2049) |
| CVE-2015-4290 | – | Jul 29 | The kernel extension in Cisco AnyConnect Secure Mobility Client 4.0(2049) on OS X allows local users to cause a denial of service (panic) via vectors involving contiguous memory… Affected: 4.0(2049) |
| CVE-2015-4211 | – | Jun 24 | Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID… Affected: 3.1(60) |
| CVE-2015-0761 | – | Jun 4 | Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, which allows local users to… Affected: through 3.1\(.07021\); 4.0(.00048); 4.0(.00051) |
| CVE-2015-0755 | – | May 29 | The Posture module for Cisco Identity Services Engine (ISE), as distributed in Cisco AnyConnect Secure Mobility Client 4.0(64), allows local users to gain privileges via… Affected: 4.0(64) |
| CVE-2015-0664 | – | Mar 18 | The IPC channel in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary userspace memory locations, and consequently gain… Affected: through 4.0\(.00051\) |
| CVE-2015-0665 | – | Mar 17 | The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID… Affected: through 4.0\(.00051\) |
| CVE-2015-0663 | – | Mar 17 | Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files… Affected: through 4.0\(.00051\) |
| CVE-2015-0662 | – | Mar 17 | Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a… Affected: through 4.0\(.00051\) |