Exploited vulnerability · CISA KEV

Is CVE-2020-3433 exploited? Yes: in CISA KEV since 24 Oct 2022

Gociux · Cisco AnyConnect Secure · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2020-3433, Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 24 Oct 2022, 798 days after it was published. It is known to be used in ransomware campaigns. It affects Cisco AnyConnect Secure, an internet-facing product of the kind attackers use for initial access. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.

What to do

1. Check whether you run it. Look for AnyConnect Secure in your asset inventory, including appliances and cloud images. Stack check lists every exploited Cisco CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 17 Aug 2020.
4. Get told next time. Email alerts when CISA adds a CVE for Cisco.

Other exploited CVEs in AnyConnect Secure

• CVE-2020-3153: Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability (24 Oct 2022)

References

• tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyc
• nvd.nist.gov/vuln/detail/CVE-2020-3433

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in October 2022 · Cisco scorecard · act-now radar.