{"id":49052,"date":"2022-10-27T12:49:42","date_gmt":"2022-10-27T12:49:42","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33980\/Cisco-AnyConnect-Windows-Client-Under-Active-Attack.html"},"modified":"2022-10-27T12:49:42","modified_gmt":"2022-10-27T12:49:42","slug":"cisco-anyconnect-windows-client-under-active-attack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cisco-anyconnect-windows-client-under-active-attack\/","title":{"rendered":"Cisco AnyConnect Windows Client Under Active Attack"},"content":{"rendered":"

Cisco says miscreants are exploiting two vulnerabilities in its AnyConnect Secure Mobility Client for Windows, which is supposed to ensure safe VPN access for remote workers.<\/p>\n

One of the pair of flaws, tracked as CVE-2020-3433<\/a>, is a privilege-escalation issue: an authenticated, local user can exploit AnyConnect to execute code with SYSTEM-level privileges. A rogue insider or malware on a PC can use this to gain total control over the system. It affects Cisco AnyConnect Secure Mobility Client for Windows releases earlier than Release 4.9.00086.<\/p>\n

The high-severity vulnerability received a 7.8 of 10 CVSS severity score, and the good news is that the networking giant released a software patch to fix the flaw a couple of years ago. Cisco first alerted customers about this bug in August 2020, and previously warned that proof-of-concept exploit code was publicly available. Now the vendor issued a fresh warning: <\/p>\n