Cisco AnyConnect Secure Mobility Client for Windows Path Traversal Local Privilege Escalation (CVE-2020-3153) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTCisco AnyConnect Secure Mobility Client for Windows versions 4.8.01090 and prior
An authenticated local attacker can copy arbitrary malicious DLL files to system-level directories, leading to arbitrary code execution with SYSTEM privileges
Immediately upgrade to the patched official release (version 4.8.02042 or later)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Administrators should deploy the latest secure version of Cisco AnyConnect (4.8.02042+ or 4.9.x). Use the following PowerShell command to perform a silent administrative upgrade via MSI:
# Silently upgrade Cisco AnyConnect to a secure version
Start-Process msiexec.exe -ArgumentList '/i "anyconnect-win-4.8.02042-core-vpn-predeploy-k9.msi" /qn /norestart /log C:\Windows\Temp\anyconnect_upgrade.log' -Wait2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict write permissions on the AnyConnect installation directories and enforce strict AppLocker or Software Restriction Policies (SRP) to prevent unauthorized DLL execution from temporary directories.
# Secure the AnyConnect installation directory permissions to prevent unauthorized file writes
icacls 'C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client' /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' /grant:r '*S-1-5-32-544:(OI)(CI)F' /grant:r '*S-1-5-32-545:(OI)(CI)R'3. Log Audit & IoC Verification Commands
Run the following PowerShell script to audit the currently installed AnyConnect version and identify if the system is vulnerable.
# Audit script to detect vulnerable Cisco AnyConnect installations
$app = Get-ItemProperty -Path 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like '*Cisco AnyConnect*' }
if ($app) {
Write-Host 'Detected Version:' $app.DisplayVersion
[version]$currentVer = $app.DisplayVersion
[version]$safeVer = '4.8.02042'
if ($currentVer -lt $safeVer) {
Write-Warning 'Vulnerable version detected! Immediate upgrade required.'
} else {
Write-Host 'System is secure (patched version installed).' -ForegroundColor Green
}
} else {
Write-Host 'Cisco AnyConnect is not installed on this machine.'
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows allows authenticated local attackers to copy user-supplied files to system-level directories. This vulnerability is caused by incorrect handling and validation of directory paths during the installation or update process, leading to a path traversal flaw.
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must first obtain valid low-privileged credentials on the target Windows system. The attacker crafts a malicious DLL and leverages the vulnerable AnyConnect installer to copy this file into a protected system directory (such as the system-level binary paths). Because the installer operates with elevated privileges, it bypasses standard user access controls, enabling DLL pre-loading or DLL hijacking attacks that execute the malicious payload under the NT AUTHORITY\SYSTEM context.
3. Infrastructure & Business Impact
As a vulnerability listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, this flaw has been actively exploited in the wild. Local Privilege Escalation (LPE) vulnerabilities are critical components of multi-stage attacks, allowing adversaries who have gained initial access to escalate their privileges, disable endpoint security controls, harvest credentials, and deploy ransomware across the enterprise network.
Official Vendor Advisories & References
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
Frequently Asked SecOps Questions (CVE-2020-3153)
FAQQ1. How critical is CVE-2020-3153 and is it actively exploited in the wild?
CVE-2020-3153 is rated CVSS 6.5 (MEDIUM) with a 30-day EPSS exploitation probability of 28.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-3153?
Primary impacted vendors include cisco across anyconnect secure mobility client. Scope summary: Cisco AnyConnect Secure Mobility Client for Windows 4.8.01090 and earlier
Q3. What temporary mitigations or workarounds exist for CVE-2020-3153 before patching?
[Mitigation] Immediately upgrade to the patched official release (version 4.8.02042 or later) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-3153
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cisco)
View Category →Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Cisco Catalyst SD-WAN Peering Authentication Bypass Vulnerability (CVE-2026-20182)
[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)
Cisco Secure Firewall Management Center (FMC) Insecure Deserialization Vulnerability (CVE-2026-20131, CVSS 10.0) - Remote Code Execution and Root Privilege Escalation
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.
Cisco Secure Firewall Management Center (FMC) Authentication Bypass and Root RCE Vulnerability (CVE-2026-20079)
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.