CVE-2020-3153

What is Cisco AnyConnect?

Cisco AnyConnect Secure Mobility Client is one of the most widely deployed enterprise VPN clients, used by organizations of all sizes to give remote employees encrypted access into corporate networks. Because AnyConnect's installer and update mechanisms run with elevated privileges on Windows endpoints, flaws in how it handles files and directory paths during install or update operations translate directly into local privilege escalation opportunities for anyone with a foothold on the machine.

Overview

CVE-2020-3153 is a vulnerability in how the AnyConnect Windows installer resolves directory paths during installation. A low-privileged local user can copy a malicious file — such as a crafted DLL — into a location that the elevated installer process will later read from or execute, achieving code execution with SYSTEM-level privileges. This is a textbook DLL hijacking/pre-loading scenario made possible by uncontrolled search-path or directory-traversal handling in the installer logic.

Technical Details

The root cause (CWE-427, Uncontrolled Search Path Element) is that the AnyConnect installer does not adequately restrict or validate the directories it searches or copies files to/from during privileged installation operations. An attacker with valid, low-privileged Windows credentials on the host can place a malicious DLL in a path the installer will later trust, and have it loaded or executed with the installer's elevated privileges — a classic "confused deputy" pattern where a privileged process trusts filesystem state that an unprivileged user can influence. Because it requires local access and existing low-privilege credentials, but no user interaction beyond triggering an install/update/repair operation, it is rated MEDIUM at 6.5.

Discovery

Identified and patched through Cisco's standard security advisory process; Cisco's own advisory documents the vulnerability without crediting an external researcher by name in the version available here.

Exploitation Context

CISA's KEV catalog listing confirms this vulnerability has been exploited in the wild, and the frontmatter notes confirmed ransomware association — consistent with attackers using local privilege escalation bugs like this one to move from an initial low-privileged foothold (often established via phishing or credential theft) to full SYSTEM control needed to disable defenses and deploy ransomware payloads.

Remediation

1. Apply the Cisco-patched version of AnyConnect Secure Mobility Client for Windows referenced in Cisco's advisory.
2. Restrict local administrative rights on endpoints to limit which users can place files in installer-accessible directories.
3. Monitor for unexpected DLL placement in AnyConnect installation or temp directories.
4. Apply endpoint protection capable of detecting DLL side-loading and hijacking techniques generally.
5. Audit systems for signs of privilege escalation activity correlated with AnyConnect install/update/repair operations predating the patch.