Secuno
ENNL
Book demo

CVE-2020-3153

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path

6.5 MEDIUMActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 28.3%
  1. Published19 Feb 2020
  2. Added to CISA KEV24 Oct 2022
  3. Remediation due14 Nov 2022
Actively exploited (CISA KEV)

Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.

Added to KEV: 24 Oct 2022Federal remediation due: 14 Nov 2022Used in ransomware

Description

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeChanged
ConfidentialityNone
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Affected products

Cisco Anyconnect Secure Mobility Client< 4.8.02042

Remediation

Fixed in
Cisco Anyconnect Secure Mobility Client≥ 4.8.02042

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1061868.6
Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows…
CVE-2026-918038.8
A local privilege escalation vulnerability exists in the updater of Foxit PDF…
CVE-2026-252648.8
Privilege escalation due to weak configuration during package extraction…
CVE-2026-549168.8
NetBox Device Type Library is a collection of community-sourced device type definitions…
CVE-2026-567958.2
Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search…
CVE-2026-875308.1
Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows…

Frequently asked

Is CVE-2020-3153 being actively exploited?

Yes. CVE-2020-3153 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 24 Oct 2022. It has been used in ransomware campaigns.

How severe is CVE-2020-3153?

CVE-2020-3153 has a CVSS 3.1 base score of 6.5, rated medium. EPSS estimates a 28.3% probability of exploitation.

Which products are affected by CVE-2020-3153?

Affected products include Cisco Anyconnect Secure Mobility Client.

How do I fix CVE-2020-3153?

Upgrade affected software to a fixed version, for example Cisco Anyconnect Secure Mobility Client 4.8.02042 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-3153 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.