{"id":"CVE-2020-3153","kind":"vulnerability","aliases":["CVE-2020-3153"],"related":[],"title":"A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an…","description":"A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.","summary":"Cisco AnyConnect Secure Mobility Client for Windows mishandles directory paths, letting a local user with valid credentials copy files to arbitrary locations with system privileges. An attacker can use this for DLL preloading and hijacking to gain SYSTEM on the machine.","severity":"high","cvss":6.5,"epss":null,"exploited":true,"exploited_at":"2022-10-24T00:00:00+00:00","products":[{"name":"Cisco AnyConnect Secure","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"cisco anyconnect secure mobility client","fixed":["4.8.02042"],"affected":"< 4.8.02042","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["anyconnect","cisco","exploited","ransomware","vendor","vpn-clients","windows"],"not_affected_if":["no-anyconnect-installed","non-windows-clients"],"how_to_check":null,"fix":"Apply the Cisco AnyConnect Secure Mobility Client update per vendor instructions (CISA KEV action); the fixed version is unknown from these sources.","status":"open","published_at":"2020-02-19T20:15:15+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:29+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:10:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco AnyConnect Secure Mobility Client update per vendor instructions (CISA KEV action); the fixed version is unknown from these sources.","reach":"local","impact":"high","summary":"Cisco AnyConnect Secure Mobility Client for Windows mishandles directory paths, letting a local user with valid credentials copy files to arbitrary locations with system privileges. An attacker can use this for DLL preloading and hijacking to gain SYSTEM on the machine.","category":"vendor","who_cares":["cisco","anyconnect","windows","vpn-clients"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains system-level privileges on Windows endpoints","analyst_note":"Find the Cisco advisory for CVE-2020-3153 to get affected and fixed versions and a how-to-check step for installed AnyConnect versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-windows-clients","no-anyconnect-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000485,"input_tokens":2875,"output_tokens":395,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2020':18A,21A '-3153':19A,22A 'allow':16A,96C,148C 'anyconnect':9A,24A,27A,31B,41B,89C 'arbitrari':60B,156C 'attack':66B,100C,127C,150C,174C,180C 'authent':98C 'cisco':8A,23A,26A,32B,40B,88C 'client':12A,30A,38B,44B,92C 'compon':6A,86C 'copi':57B,102C,138C,152C 'could':15A,95C,128C,147C,163C 'creat':133C 'credenti':56B,183C 'cve':17A,20A 'directori':48B,110C,124C,144C 'dll':71B,165C,169C 'due':118C 'exploit':33B,129C,146C,176C 'file':58B,106C,136C,140C,154C 'gain':76B 'handl':122C 'hijack':74B,170C 'includ':164C 'incorrect':121C 'instal':5A,85C 'let':50B 'level':109C,113C,160C 'load':168C 'local':52B,99C 'locat':61B,157C 'machin':80B 'malici':135C,153C 'mishandl':47B 'mobil':11A,43B,91C 'mobility':29A 'need':181C 'path':49B,125C 'pre':167C 'pre-load':166C 'preload':72B 'privileg':64B,114C,161C 'ransomwar':34B 'relat':173C 'secur':10A,42B,90C 'secure':25A,28A 'suppli':105C 'system':63B,77B,108C,112C,143C,159C,187C 'use':68B 'user':53B,104C 'user-suppli':103C 'valid':55B,182C 'vendor':35B 'vpn':37B 'vpn-client':36B 'vulner':2A,82C,116C,131C,178C 'window':14A,39B,46B,94C,186C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-02-19T20:15:15+00:00","kev":{"dateAdded":"2022-10-24","dueDate":"2022-11-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-3153","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-3153","severity":null,"published_at":"2022-10-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-3153","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-3153","severity":null,"published_at":"2020-02-19T20:15:15+00:00","modified_at":"2026-08-12T05:17:29+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}