CVE-2020-3153
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Description
CVE-2020-3153 is an uncontrolled search path element (DLL hijacking) vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows. Due to incorrect handling of directory paths, an authenticated local attacker can copy user-supplied files into system-level directories with system privileges, enabling DLL pre-loading and DLL hijacking attacks. This vulnerability has a CVSS score of 6.5 (MEDIUM) but is listed in CISA's Known Exploited Vulnerabilities catalog and has been linked to ransomware campaigns, making it a critical remediation priority. With an EPSS score of approximately 25.1% and 96th-percentile ranking, CVE-2020-3153 carries a significantly elevated exploitation probability compared to most known vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | anyconnect secure mobility client | < 4.8.02042 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
References
- http://packetstormsecurity.com/files/157340/Cisco-AnyConnect-Secure-Mobility-Client-4.8.01090-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158219/Cisco-AnyConnect-Path-Traversal-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2020/Apr/43(Exploit, Mailing List, Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3153(US Government Resource)
Weakness Type
CWE-427: Uncontrolled Search Path Element
CWE-427 describes a vulnerability where an application uses a search path that can be controlled by an attacker to load malicious code. In the context of CVE-2020-3153, the Cisco AnyConnect Secure Mobility Client installer fails to properly validate or restrict directory paths when copying files, allowing an attacker to place malicious DLLs in locations that will be loaded with elevated system privileges.
Learn more: CWE-427 — Uncontrolled Search Path Element
Impact Analysis
CVE-2020-3153 is locally exploitable, meaning an attacker must have valid credentials on the target Windows system — they cannot exploit this remotely over a network. However, the attack complexity is low and no user interaction is required, making exploitation straightforward once local access is obtained. Integrity (High): The core impact is the ability to copy malicious files into arbitrary system-level directories with SYSTEM-level privileges, effectively allowing full control over the integrity of critical system components. Confidentiality (None): The vulnerability does not directly expose sensitive data, though subsequent payloads dropped via DLL hijacking may access confidential information. Availability (None): Availability is not directly impacted by the path traversal itself. The scope is changed, meaning the vulnerability can affect resources and components beyond the vulnerable Cisco AnyConnect installer itself. With a CVSS 3.1 score of 6.5 (MEDIUM) and confirmed ransomware association in the KEV catalog, the real-world severity is considerably higher than the base score implies.
Exploit Maturity
CVE-2020-3153 has a well-documented public exploit landscape. Public exploit code is available via Packet Storm Security (Privilege Escalation, v4.8.01090), Packet Storm Security (Path Traversal), and Packet Storm Security (Privilege Escalation), as well as a Full Disclosure mailing list entry. CISA has confirmed active exploitation of this vulnerability in the wild through its inclusion in the Known Exploited Vulnerabilities catalog, and it has been associated with ransomware campaigns. The EPSS score of 25.1% places this vulnerability in the 96th percentile of all CVEs for exploitation probability, strongly indicating ongoing malicious activity.
Remediation
- Apply Cisco's vendor patch immediately: Follow Cisco Security Advisory cisco-sa-ac-win-path-traverse-qO4HWBsj and apply all available updates to Cisco AnyConnect Secure Mobility Client for Windows.
- Upgrade to a patched version: Cisco AnyConnect versions after 4.8.01090 include fixes for this path traversal issue — verify that your deployed version is no longer affected per the vendor advisory.
- Restrict local user privileges: Ensure that only administrators can run the AnyConnect installer. Limit the ability of standard users to place files in directories used during the installation process.
- Monitor for DLL hijacking indicators: Review event logs and endpoint detection systems for signs of unusual DLL loads from unexpected directories, particularly those associated with Cisco AnyConnect processes.
- Apply application whitelisting: Use Windows Defender Application Control (WDAC) or AppLocker to restrict which DLLs can be loaded by the AnyConnect installer, mitigating the impact of uncontrolled search path exploitation.
Technical Details
CVE-2020-3153 stems from an uncontrolled search path element (CWE-427) in the Cisco AnyConnect Secure Mobility Client installer for Windows. The installer incorrectly handles directory paths when copying user-supplied files, failing to canonicalize or validate destination paths before performing privileged file copy operations. An attacker with valid local credentials can craft a malicious file and supply a path that resolves to a system-level directory, causing the installer to copy the file there with SYSTEM privileges. This enables DLL pre-loading — where a malicious DLL is placed in a directory searched before legitimate system paths — and DLL hijacking, where a legitimate application subsequently loads the attacker-controlled DLL instead of the intended library. The CVSS:3.1 vector string AV:L/AC:L/PR:L/UI:N/S:C reflects that exploitation requires only low-privilege local access, no special conditions, and no user interaction, yet the changed scope indicates the impact extends beyond the AnyConnect process to the broader system.
Frequently Asked Questions
Is CVE-2020-3153 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2020-3153 in its Known Exploited Vulnerabilities catalog with a remediation due date of 2022-11-14. This vulnerability has also been associated with ransomware campaigns, and multiple public exploit tools are available. The EPSS score of 25.1% (96th percentile) reflects a high real-world exploitation probability.
What products are affected by CVE-2020-3153?
CVE-2020-3153 affects the Cisco AnyConnect Secure Mobility Client for Windows, specifically the installer component. The vulnerability was confirmed in version 4.8.01090 and earlier versions of the Windows client. Organizations running unpatched Cisco AnyConnect on Windows endpoints should treat this as a priority remediation.
How do I fix CVE-2020-3153?
Apply the patch provided in Cisco Security Advisory cisco-sa-ac-win-path-traverse-qO4HWBsj and upgrade Cisco AnyConnect to a version that addresses this path traversal flaw. As interim measures, restrict installer execution to administrative users and monitor endpoint logs for DLL hijacking indicators. See the Remediation section for detailed steps.
How severe is CVE-2020-3153?
CVE-2020-3153 carries a CVSS 3.1 base score of 6.5 (MEDIUM), but its real-world severity is significantly higher due to KEV catalog inclusion, confirmed ransomware association, and multiple publicly available exploits. Its EPSS percentile of 96.1% places it among the most likely-to-be-exploited vulnerabilities in the NVD database.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.