Dashboard / CVE-2020-3153

CVE-2020-3153

CISA KEV RANSOMWARE
ACT NOW Priority: 0.00 BB Relevance: 0/100
Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.

CISA Known Exploited Vulnerability

Vendor / Product Cisco — AnyConnect Secure
Date Added 2022-10-24
Remediation Due 2022-11-14
Ransomware Use CONFIRMED
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj; https://nvd.nist.gov/vuln/detail/CVE-2020-3153

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
cisco anyconnect_secure_mobility_client < 4.8.02042

References & Advisories (6)

http://seclists.org/fulldisclosure/2020/Apr/43
Exploit Mailing List Third Party Advisory

Bug Bounty Relevance

0 / 100
✓ Known exploited (KEV)

CVSS Score

Unscored

EPSS — Exploitation Probability

No EPSS data available

Intelligence Sources

kev ref →

External Links