What is CVE-2021-1258?

CVE-2021-1258 is a medium-severity vulnerability in Cisco Anyconnect_secure_mobility_client, classified under CWE-264. CVSS score: 5.5/10. Published 2021-01-13.

How severe is CVE-2021-1258?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Privilege escalation in Cisco Anyconnect_secure_mobility_client

CVE-2021-1258

A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read arbitrary files on the underlying operating system (OS) of an affected device. The…

EPSS: 0.003 (26.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Cisco Anyconnect_secure_mobility_client
Cisco Anyconnect Secure Mobility Client — versions n/a
Mcafee Agent_epolicy_orchestrator_extension
Microsoft Windows

Weakness classification (CWE)

CWE-264
CWE-269 — Improper Privilege Management

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2021-1258?: CVE-2021-1258 is a medium-severity vulnerability in Cisco Anyconnect_secure_mobility_client, classified under CWE-264. CVSS score: 5.5/10. Published 2021-01-13.
How severe is CVE-2021-1258?: Medium severity. CVSS v3 base score is 5.5 out of 10.