CVE-2023-20178 Privilege escalation in Cisco Secure Client
A local attacker can elevate privileges to SYSTEM by exploiting improper permissions in the client update process of Cisco Secure Client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-20178?
CVE-2023-20178 is a high-severity vulnerability in Cisco Anyconnect Secure Mobility Client, published on 28 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established. This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.
Weakness: CWE-276
Which versions are affected by CVE-2023-20178?
It affects 2 products.
Products include Cisco Anyconnect Secure Mobility Client, Cisco Secure Client.
How do I fix CVE-2023-20178?
No fix has been published for CVE-2023-20178 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-20178 being exploited?
There is no known exploitation of CVE-2023-20178 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Cisco Anyconnect Secure Mobility Client
Sources
Also known as GHSA-6rj9-hcv7-94r5.