Skip to main content

Cisco Warns AnyConnect VPNs Under Active Cyberattack

  • October 26, 2022
  • 5 replies
  • 20 views

Jasper_The_Rasper
Moderator
Forum|alt.badge.img+54

Older bugs in the AnyConnect Secure Mobility Client are being targeted in the wild, showcasing patch-management failures.

 

October 26, 2022 By Tara Seals

 

A pair of known security vulnerabilities in the Cisco AnyConnect Secure Mobility Client for Windows is being actively exploited in the wild, despite being patched for two-plus years.

The networking giant is warning that cybercrime groups are pressing two local privilege escalation (LPE) bugs into service, with active exploit chains against the VPN platform being observed starting this month.

The first flaw (CVE-2020-3153, with a CVSS score of 6.5) would allow a logged-in user to send a specially crafted IPC message to the AnyConnect process to perform DLL hijacking and execute arbitrary code on the affected machine with SYSTEM privileges. The second issue (CVE-2020-3433, with a CVSS score of 7.8) could allow a logged-in user to copy arbitrary files to system-level directories with SYSTEM privileges.

 

>> Full Article <<

5 replies

Jamesharris85
New Voice
Forum|alt.badge.img+4

I am easily confused and not the sharpest knife in the drawer...but if its been patched for two years, how are they exploiting it?


Jamesharris85
New Voice
Forum|alt.badge.img+4

Ignore me, just read the whole article and it makes sense now. 

 


MajorHavoc
Bronze VIP
Forum|alt.badge.img+25
  • Bronze VIP
  • October 27, 2022

Thanks for your second post James, because I started to write the exact same question as your first post. I’m curious though, is this a new trend in cyber attacks? Going after patched or fixed vulnerabilities looking for cracks in the repairs?


Jamesharris85
New Voice
Forum|alt.badge.img+4

Glad I wasn’t the only one then 🤣


Martin.1
Popular Voice
Forum|alt.badge.img+4
  • Popular Voice
  • October 28, 2022

@MajorHavoc  That is where a lot of gaps is in I would assume. a patch that has been patched with a patched, and in-between, there are gaps that can be exploited. Shocking to me is that this is Cisco…...