# CVE-2020-3153

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

- Page: https://www.vulneraibility.com/cve/CVE-2020-3153
- CVSS: 6.5
- Known exploited: yes, in CISA KEV since 2022-10-24; CISA due date 2022-11-14; known ransomware use
- EPSS: 28.52% (percentile 98.2)
- Public exploit code: 1 Metasploit module · 3 GitHub proofs of concept (first 2020-05-04)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2020-07-27)
- Weakness: CWE-427
- Published: 2020-02-19

## Affected versions

- Cisco Cisco AnyConnect Secure Mobility Client: affected < n/a

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj
- [other] http://seclists.org/fulldisclosure/2020/Apr/43
- [other] http://packetstormsecurity.com/files/157340/Cisco-AnyConnect-Secure-Mobility-Client-4.8.01090-Privilege-Escalation.html
- [other] http://packetstormsecurity.com/files/158219/Cisco-AnyConnect-Path-Traversal-Privilege-Escalation.html
- [other] http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3153

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.