Cisco has disclosed today a zero-day vulnerability in the Cisco AnyConnect Secure Mobility Client software with proof-of-concept exploit code publicly available.

While security updates are not yet available for this arbitrary code execution vulnerability, Cisco is working on addressing the zero-day, with a fix coming in a future AnyConnect client release.

However, the Cisco AnyConnect Secure Mobility Client security flaw has not yet been exploited in the wild according to the Cisco Product Security Incident Response Team (PSIRT).

Devices with default configurations not vulnerable

The high severity vulnerability tracked as CVE-2020-3556 exists in the interprocess communication (IPC) channel of Cisco AnyConnect Client and it may allow authenticated and local attackers to execute malicious scripts via a targeted user.

It affects all AnyConnect client versions for Windows, Linux, and macOS with vulnerable configurations — mobile iOS and Android clients are not impacted by this vulnerability.

“A vulnerable configuration requires both the Auto Update setting and Enable Scripting setting to be enabled,” Cisco explains. “Auto Update is enabled by default, and Enable Scripting is disabled by default.”

Successful exploitation also requires active AnyConnect sessions and valid credentials on the targeted device.

Mitigation available

Even though there are no workarounds available to address CVE-2020-3556, it can be mitigated by disabling the Auto Update feature.

The attack surface can also be drastically decreased by toggling off the Enable Scripting configuration setting on devices where it’s enabled.

The vulnerability was reported to Cisco by Gerbert Roitburd from Secure Mobile Networking Lab (TU Darmstadt).

Cisco today also fixed 11 other high severity and 23 medium severity security bugs in multiple products that could lead to denial of service or arbitrary code execution on vulnerable devices.

Cisco also fixed actively exploited flaws in several carrier-grade routers and the ASA/FTD firewall in September and July, respectively.

The information contained in this website is for general information purposes only. The information is gathered from BLEEPING COMPUTER, while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.  Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.