{"id":"CVE-2020-3433","published":"2020-08-17T18:15:12Z","modified":"2026-08-12T05:17:30Z","title":"Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability","vendor":"Cisco","product":"AnyConnect Secure","tier":"core","eol":null,"description":{"text":"A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an insufficient validation of resources loaded at run time in the interprocess communication channel of Cisco AnyConnect Secure Mobility Client for Windows, enabling DLL hijacking. An authenticated local attacker holding valid credentials on the Windows system can exploit it by sending a crafted IPC message to the AnyConnect process, which can lead to arbitrary code execution with SYSTEM privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:00:13Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.10049,"percentile":0.95609,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-10-24","dueDate":"2022-11-14","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW; https://nvd.nist.gov/vuln/detail/CVE-2020-3433","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-10-20","exploitedFirstSeen":"2022-10-20","ransomware":true,"evidence":[{"url":"https://thehackernews.com/2022/10/oldgremlin-ransomware-targeted-over.html","date":"2022-10-20"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-10-24"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-427","name":"Uncontrolled Search Path Element"}],"references":[{"url":"http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3433","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Requires valid local credentials to exploit","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"the attacker would need to have valid credentials on the Windows system","start":230,"end":301}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-24704","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24704","exploited":true,"exploitedSince":"2022-10-24","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2020-09-25","earliestUrl":"https://github.com/goichot/CVE-2020-3433","repos":[{"name":"goichot/CVE-2020-3433","url":"https://github.com/goichot/CVE-2020-3433","stars":41,"created":"2020-09-25"}]},"metasploit":[{"name":"Cisco AnyConnect Privilege Escalations (CVE-2020-3153 and CVE-2020-3433)","module":"exploit/windows/local/anyconnect_lpe","type":"exploit","disclosureDate":"2020-08-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/anyconnect_lpe.rb"}],"first":{"date":"2020-08-05","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/anyconnect_lpe.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2020-08-05","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2020-09-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/anyconnect_lpe.rb","provenance":"source"},{"date":"2020-08-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-3433","provenance":"source"},{"date":"2022-10-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://thehackernews.com/2022/10/oldgremlin-ransomware-targeted-over.html","provenance":"source"},{"date":"2022-10-24","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-10-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24704","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":798},"priority":{"score":77.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1470 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.12,"detail":"percentile 0.9561"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}