CVE-2020-3433β€”Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

PUBLISHEDvulnerability record
2022-10-24 Β· last modified June 21, 2025

Metadata

CVE ID:
CVE-2020-3433
Project:
Cisco
Product:
AnyConnect Secure
Date Added:
2022-10-24
Due Date:
2022-11-14
Last Updated:
June 21, 2025

Vulnerability Name

Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

Description

Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:
KNOWN

Action

Apply updates per vendor instructions.

Additional Notes

  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW
  • https://nvd.nist.gov/vuln/detail/CVE-2020-3433

Related Weaknesses

browse all CVEs