{"id":"CVE-2020-3153","published":"2020-02-19T20:15:15Z","modified":"2026-08-12T05:17:29Z","title":"Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability","vendor":"Cisco","product":"AnyConnect Secure","tier":"core","eol":null,"description":{"text":"A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.","provenance":"source","from":"NVD"},"summary":{"text":"The installer component of Cisco AnyConnect Secure Mobility Client for Windows mishandles directory paths, creating an uncontrolled search path flaw. An authenticated local attacker with valid credentials on the Windows system can craft a malicious file and copy it to system-level directories with system-level privileges, enabling DLL pre-loading or DLL hijacking, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:00:36Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.28515,"percentile":0.98127,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-10-24","dueDate":"2022-11-14","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj; https://nvd.nist.gov/vuln/detail/CVE-2020-3153","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-10-20","exploitedFirstSeen":"2022-10-20","ransomware":true,"evidence":[{"url":"https://thehackernews.com/2022/10/oldgremlin-ransomware-targeted-over.html","date":"2022-10-20"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-10-24"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-427","name":"Uncontrolled Search Path Element"}],"references":[{"url":"http://packetstormsecurity.com/files/157340/Cisco-AnyConnect-Secure-Mobility-Client-4.8.01090-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/158219/Cisco-AnyConnect-Path-Traversal-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2020/Apr/43","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/157340/Cisco-AnyConnect-Secure-Mobility-Client-4.8.01090-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/158219/Cisco-AnyConnect-Path-Traversal-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2020/Apr/43","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3153","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Requires valid local credentials to exploit","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"the attacker needs valid credentials on the Windows system","start":639,"end":697}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1036","name":"Masquerading","tactics":["stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Malicious files placed in system directories masquerade as legitimate","mappingType":"primary_impact","evidence":[{"from":"description","quote":"copy malicious files to arbitrary locations with system level privileges","start":456,"end":528}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1574.001","name":"DLL","tactics":["execution","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: DLL hijacking loads attacker code via search order","mappingType":"primary_impact","evidence":[{"from":"description","quote":"This could include DLL pre-loading, DLL hijacking, and other related attacks","start":530,"end":606}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-24424","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24424","exploited":true,"exploitedSince":"2022-10-24","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2020-05-04","earliestUrl":"https://github.com/shubham0d/CVE-2020-3153","repos":[{"name":"goichot/CVE-2020-3153","url":"https://github.com/goichot/CVE-2020-3153","stars":103,"created":"2020-05-19"},{"name":"shubham0d/CVE-2020-3153","url":"https://github.com/shubham0d/CVE-2020-3153","stars":5,"created":"2020-05-04"},{"name":"raspberry-pie/CVE-2020-3153","url":"https://github.com/raspberry-pie/CVE-2020-3153","stars":0,"created":"2020-05-15"}]},"metasploit":[{"name":"Cisco AnyConnect Privilege Escalations (CVE-2020-3153 and CVE-2020-3433)","module":"exploit/windows/local/anyconnect_lpe","type":"exploit","disclosureDate":"2020-08-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/anyconnect_lpe.rb"}],"first":{"date":"2020-05-04","source":"PoC-in-GitHub","url":"https://github.com/shubham0d/CVE-2020-3153"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/157340/Cisco-AnyConnect-Secure-Mobility-Client-4.8.01090-Privilege-Escalation.html","http://packetstormsecurity.com/files/158219/Cisco-AnyConnect-Path-Traversal-Privilege-Escalation.html","http://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.html","http://seclists.org/fulldisclosure/2020/Apr/43"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1574.001","T1036"],"provenance":"ai"}],"timeline":[{"date":"2020-02-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-3153","provenance":"source"},{"date":"2020-05-04","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2020-08-05","url":"https://github.com/shubham0d/CVE-2020-3153","provenance":"source"},{"date":"2022-10-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://thehackernews.com/2022/10/oldgremlin-ransomware-targeted-over.html","provenance":"source"},{"date":"2022-10-24","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-10-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24424","provenance":"source"}],"speed":{"daysToPublicExploit":75,"firstExploitFrom":"PoC-in-GitHub","daysToKev":978},"priority":{"score":77.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1472 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.63,"detail":"percentile 0.9813"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 3 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}