$ cve CVE-2020-3153 JSON

CVE-2020-3153 KEV

6.5

MEDIUM · CVSS 3.1 · EPSS 28.3% (pctl 98)

Patch first

On CISA KEV — known exploited in the wild, due 2022-11-14.

Description

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

Scoring

CVSS	6.5 (MEDIUM, v3.1)
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
EPSS	28.31% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-427
On CISA KEV	yes — remediate by 2022-11-14
Public exploit	none known
Published	2020-02-19
Last modified	2026-08-12

CISA KEV

Name	Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Added	2022-10-24
Due	2022-11-14
Vendor / product	Cisco / AnyConnect Secure
Ransomware use	known

Affected (1)

Vendor	Product
cisco	anyconnect secure mobility client

References

→ the Explorer · watch your stack · NVD