CVE-2020-3433

Cisco AnyConnect Secure — Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
⚠️ CVSS 3.1  7.8 / 10 — HIGH 🔴 CISA Known Exploited Vulnerability

Overview

Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW; https://nvd.nist.gov/vuln/detail/CVE-2020-3433

Key Details

PropertyValue
CVE ID CVE-2020-3433
Vendor / Product Cisco — AnyConnect Secure
NVD Published2020-08-17
NVD Last Modified2025-10-28
CVSS 3.1 Score7.8
CVSS 3.1 VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SeverityHIGH
CWE CWE-427
CISA KEV Added2022-10-24
CISA KEV Deadline2022-11-14
Known Ransomware Use ⚠️ Yes

CVSS 3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Required Action

CISA BOD 22-01 Deadline: 2022-11-14. Apply updates per vendor instructions.

Timeline

DateEvent
2022-10-24Added to CISA Known Exploited Vulnerabilities catalog
2022-11-14CISA BOD 22-01 remediation deadline

References

ResourceType
NVD — CVE-2020-3433 Vulnerability Database
CISA KEV Catalog Entry US Government