Exploited Vulnerabilities DailyCVE-2020-3433: Cisco AnyConnect Secure
EPSS10.0%No. 1280 of 1739 in KEV
CVE year2020~2 yrs before listing
Same vendor in KEV100
Same product2
| Field | Value |
|---|---|
| Vendor | Cisco |
| Product | AnyConnect Secure |
| Name | Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability |
| Added to KEV | 2022-10-24 |
| US federal due date | 2022-11-14 |
| Ransomware use | Known |
| CWE | CWE-427 |
CISA description
Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.
Other entries for this product
| CVE | Vendor / product | Added | EPSS | Ransomware |
|---|---|---|---|---|
| CVE-2020-3153 | Cisco AnyConnect Secure | 2022-10-24 | 28.3% | Known |
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A Cisco AnyConnect Secure vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2022-10-24.