What is CVE-2024-20338?

CVE-2024-20338 is a high-severity vulnerability in Cisco Secure Client, classified under Uncontrolled Search Path Element. CVSS score: 7.3/10. Published 2024-03-06.

How severe is CVE-2024-20338?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2024-20338 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Cisco Secure Client

CVE-2024-20338

A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to the use of an uncontrolled s…

EPSS: 0.009 (54.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

Public proof-of-concept exploits

References

psirt@cisco.com (Vendor Advisory)

Frequently asked questions

What is CVE-2024-20338?: CVE-2024-20338 is a high-severity vulnerability in Cisco Secure Client, classified under Uncontrolled Search Path Element. CVSS score: 7.3/10. Published 2024-03-06.
How severe is CVE-2024-20338?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2024-20338 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.