Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Cisco · AnyConnect Secure
The installer component of Cisco AnyConnect Secure Mobility Client for Windows mishandles directory paths, creating an uncontrolled search path flaw. An authenticated local attacker with valid credentials on the Windows system can craft a malicious file and copy it to system-level directories with system-level privileges, enabling DLL pre-loading or DLL hijacking, with no user interaction required.
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 5/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 3 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 months after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+2 mo
- First seen exploitedVulnCheck KEV evidence+3 yrs
- Added to CISA KEVknown ransomware use; EU database agrees+3 yrs
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
3 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 3 cited passages 3Initial AccessTA0001
Requires valid local credentials to exploit
the attacker needs valid credentials on the Windows system
ExecutionTA0002
DLL hijacking loads attacker code via search order
This could include DLL pre-loading, DLL hijacking, and other related attacks
Stealth
Malicious files placed in system directories masquerade as legitimate
copy malicious files to arbitrary locations with system level privileges
Detection
0 rules for this CVE · 189 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2020-3153 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Valid AccountsT107856 general rules
- Win Susp Computer Name Containing Samtheadmincriticaltest
- Account Created And Deleted Within A Close Time Framehightest
- Activity From Anonymous IP Addresshightest
- Atypical Travelhightest
- Azure AD Threat Intelligencehightest
- Azure Subscription Permission Elevation Via AuditLogshightest
- External Remote SMB Logon from Public IPhightest
- Impossible Travelhightest
DLLT1574.00193 general rules
- Winnti Pipemon Characteristicscriticalstable
- APT27 - Emissary Panda Activitycriticaltest
- Winnti Malware HK University Campaigncriticaltest
- Suspicious Unsigned Thor Scanner Executionhighstable
- Aruba Network Service Potential DLL Sideloadinghightest
- DHCP Callout DLL Installationhightest
- DHCP Server Error Failed Loading the CallOut DLLhightest
- DHCP Server Loaded the CallOut DLLhightest
MasqueradingT103640 general rules
- Potential LSASS Process Dump Via Procdumphighstable
- CreateDump Process Dumphightest
- Forfiles.EXE Child Process Masqueradinghightest
- HackTool - XORDump Executionhightest
- Password Protected ZIP File Opened (Suspicious Filenames)hightest
- Potential SysInternals ProcDump Evasionhightest
- Process Execution From A Potentially Suspicious Folderhightest
- Process Memory Dump Via Comsvcs.DLLhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX