Secuno
ENNL
Book demo

CVE-2020-3433

Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking

7.8 HIGHActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 10.0%
  1. Published17 Aug 2020
  2. Added to CISA KEV24 Oct 2022
  3. Remediation due14 Nov 2022
Actively exploited (CISA KEV)

Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.

Added to KEV: 24 Oct 2022Federal remediation due: 14 Nov 2022Used in ransomware

Description

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Cisco Anyconnect Secure Mobility Client< 4.9.00086

Remediation

Fixed in
Cisco Anyconnect Secure Mobility Client≥ 4.9.00086

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1061868.6
Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows…
CVE-2026-918038.8
A local privilege escalation vulnerability exists in the updater of Foxit PDF…
CVE-2026-252648.8
Privilege escalation due to weak configuration during package extraction…
CVE-2026-549168.8
NetBox Device Type Library is a collection of community-sourced device type definitions…
CVE-2026-567958.2
Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search…
CVE-2026-875308.1
Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows…

Frequently asked

Is CVE-2020-3433 being actively exploited?

Yes. CVE-2020-3433 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 24 Oct 2022. It has been used in ransomware campaigns.

How severe is CVE-2020-3433?

CVE-2020-3433 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 10.0% probability of exploitation.

Which products are affected by CVE-2020-3433?

Affected products include Cisco Anyconnect Secure Mobility Client.

How do I fix CVE-2020-3433?

Upgrade affected software to a fixed version, for example Cisco Anyconnect Secure Mobility Client 4.9.00086 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-3433 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.