Improper input validation in Cisco Anyconnect_secure_mobility_client
CVE-2017-6638
A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and run an executable file with privileges equivalent to the Microsoft Windows SYS…
EPSS: 0.001 (19.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cisco Anyconnect_secure_mobility_client
- N/a Cisco Anyconnect Local Privilege Escalation Vulnerability — versions Cisco AnyConnect Local Privilege Escalation Vulnerability
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2017-6638?
- CVE-2017-6638 is a high-severity vulnerability in Cisco Anyconnect_secure_mobility_client, classified under CWE-264. CVSS score: 7.8/10. Published 2017-06-08.
- How severe is CVE-2017-6638?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2017-6638 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.