cisco anyconnect vpn client download windows

The vulnerability is due to the incorrect handling of directory paths, Cisco stated. The second vulnerability is in the installer component of Cisco An圜onnect Secure Mobility Client for Windows that could allow an authenticated local attacker to copy user-supplied files to system-level directories with system level privileges.

“A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges.”Ĭisco fixed this vulnerability in Cisco An圜onnect Secure Mobility Client for Windows releases 6 and later. An attacker could exploit this vulnerability by sending a crafted IPC message to the An圜onnect process,” Cisco stated. “The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system, Cisco stated. The first vulnerability involves a weakness in the interprocess communication (IPC) channel of Cisco An圜onnect Secure Mobility Client for Windows that could let an authenticated local attacker perform a Microsoft Dynamic Link Libranry (DLL) hijacking attack.

There are no workarounds for the problems, but software updates are available to address them, Cisco stated. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability,” the vendor said in its alert for both vulnerabilities. “In October 2022, the Cisco PSIRT became aware of additional attempted exploitation of this vulnerability in the wild.

Cisco anyconnect vpn client download windows