CVE-2020-3433
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
Description
CVE-2020-3433 is a DLL hijacking vulnerability (CWE-427) in the Cisco AnyConnect Secure Mobility Client for Windows, specifically in its interprocess communication (IPC) channel. An authenticated, local attacker with valid Windows credentials can exploit this vulnerability by sending a crafted IPC message to the AnyConnect process, causing it to load a malicious DLL and execute arbitrary code with SYSTEM privileges. The flaw stems from insufficient validation of resources loaded by the application at runtime. CVE-2020-3433 is particularly dangerous because it has been linked to ransomware campaigns, and CISA has added it to the Known Exploited Vulnerabilities catalog. Public exploit code is also available, further elevating the risk.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | anyconnect secure mobility client | < 4.9.00086 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3433(US Government Resource)
Weakness Type
CWE-427: Uncontrolled Search Path Element
CWE-427 describes a weakness where a product uses a fixed or controlled search path to find resources, but one or more locations in that path can be modified by an attacker. In CVE-2020-3433, the Cisco AnyConnect Secure Mobility Client for Windows fails to sufficiently validate the DLL files it loads at runtime, allowing an attacker with local access to place a malicious DLL in a location the application searches, causing the application to load and execute the attacker's code instead of the legitimate library.
Learn more: CWE-427 — Uncontrolled Search Path Element
Impact Analysis
CVE-2020-3433 has a CVSS 3.1 score of 7.8 (High), reflecting a serious local privilege escalation risk. Attack Vector (Local): the attacker must have local access to the Windows system, meaning they need existing code execution — but not elevated privileges — on the target. Attack Complexity (Low): once local access is established, exploiting this vulnerability requires no special conditions; the DLL can be placed and the IPC message crafted without complex prerequisites. Privileges Required (Low): the attacker needs only standard, authenticated Windows user credentials, making this accessible to any user-level attacker or malware already running in a limited context. User Interaction (None): no victim interaction is needed beyond the attacker's own actions. Confidentiality, Integrity, and Availability (all High): successful exploitation allows arbitrary code execution with SYSTEM privileges — the highest privilege level on a Windows system — giving the attacker complete control over the machine, all its data, and connected resources. The ransomware association (KEV Ransomware: Known) means this vulnerability has been actively used to escalate privileges as part of ransomware deployment chains, making rapid remediation critical.
Exploit Maturity
CVE-2020-3433 has a well-established exploitation footprint. Public exploit code is available for CVE-2020-3433 via Packet Storm Security, providing a concrete proof-of-concept that security researchers and threat actors can use. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog, and — critically — the KEV entry identifies this as linked to known ransomware campaigns, meaning threat actors have leveraged this DLL hijacking vulnerability to escalate privileges as part of ransomware deployment. The EPSS score of 4.46% (89th percentile) places CVE-2020-3433 in the top 11% of all CVEs by exploitation probability, indicating substantial and ongoing exploitation risk. Any organization running Cisco AnyConnect on Windows endpoints should treat this as an actively weaponized vulnerability.
Remediation
- Apply Cisco's security patch — Per CISA's KEV required action, apply mitigations per Cisco's vendor instructions. Review Cisco Security Advisory cisco-sa-anyconnect-dll-F26WwJW for the specific patched versions of AnyConnect Secure Mobility Client and upgrade immediately.
- Upgrade to a non-vulnerable AnyConnect version — The vulnerability affects AnyConnect for Windows. Check the Cisco advisory for the minimum fixed release and ensure all Windows endpoints running AnyConnect are on a patched version.
- Restrict local user write access to AnyConnect directories — As an interim mitigation, use Windows access control lists (ACLs) to prevent standard users from writing files to directories searched by the AnyConnect IPC process, reducing the opportunity for DLL planting.
- Monitor for DLL hijacking indicators — Use endpoint detection and response (EDR) tools to detect anomalous DLL loading behavior by the AnyConnect process, particularly unsigned DLLs being loaded from non-standard paths.
- Apply principle of least privilege — Restrict Windows user accounts to the minimum required privileges. Since exploitation requires an authenticated local user, limiting what attackers can do after initial access reduces the blast radius if CVE-2020-3433 is exploited as part of a broader attack chain.
Technical Details
CVE-2020-3433 exploits an uncontrolled search path element (CWE-427) in the IPC channel of the Cisco AnyConnect Secure Mobility Client for Windows. When the AnyConnect process handles IPC messages, it dynamically loads resources — specifically DLL files — at runtime without sufficiently validating their origin, signature, or path. An attacker who can send a crafted IPC message to the AnyConnect process can manipulate which DLL is loaded by placing a malicious library in a location that the application's search path resolves before the legitimate system DLL. Because AnyConnect runs with elevated SYSTEM privileges as part of its VPN functionality, any code loaded into its process space inherits those SYSTEM-level privileges. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects that exploitation requires only local access with standard user credentials, no special conditions, and no victim interaction, while delivering complete system compromise. This DLL hijacking pattern is a classic Windows local privilege escalation technique that is particularly effective when targeting highly privileged service processes like VPN clients.
Frequently Asked Questions
Is CVE-2020-3433 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2020-3433 and has included it in the Known Exploited Vulnerabilities catalog. Critically, the KEV entry indicates that this vulnerability has been used in known ransomware campaigns, meaning threat actors are actively leveraging it for privilege escalation as part of ransomware deployment. Public exploit code is also available via Packet Storm Security.
What products are affected by CVE-2020-3433?
CVE-2020-3433 affects Cisco AnyConnect Secure Mobility Client for Windows. Other platforms (macOS, Linux, mobile) are not affected by this specific IPC channel vulnerability. Refer to Cisco Security Advisory cisco-sa-anyconnect-dll-F26WwJW for the specific affected version ranges and the minimum fixed release.
How do I fix CVE-2020-3433?
Upgrade Cisco AnyConnect Secure Mobility Client for Windows to a version that includes Cisco's fix for this DLL hijacking vulnerability. Consult Cisco Security Advisory cisco-sa-anyconnect-dll-F26WwJW for the exact patched version. As an interim measure, restrict standard user write access to directories in AnyConnect's DLL search path.
How severe is CVE-2020-3433?
CVE-2020-3433 has a CVSS 3.1 score of 7.8 (High severity). The EPSS score of 4.46% places it at the 89th percentile for exploitation probability, indicating significantly elevated real-world exploitation risk. Combined with confirmed ransomware association and public exploit code availability, this vulnerability should be treated as critically urgent for any organization running Cisco AnyConnect on Windows endpoints.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.