Anyconnect Secure Mobility ClientApplication · Cisco
CVE-2023-20178
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established. This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThis is a local privilege escalation vulnerability in Cisco AnyConnect Secure Mobility Client and Cisco Secure Client for Windows. The vulnerability exists in the client update process (which runs after a successful VPN connection) due to improper permissions on a temporary directory created during updates. An attacker with low-privileged local access can abuse a specific Windows installer function to inject and execute code with SYSTEM-level privileges.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Anyconnect Secure Mobility ClientApplication
< 4.10.07061
Secure ClientApplication
< 5.0.02075CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed Cisco VPN client productOpen Programs and Features in Windows Control Panel and look for 'Cisco AnyConnect Secure Mobility Client' or 'Cisco Secure Client' in the installed programs listAffected if Either product is present on the system
-
Check installed version numberRight-click the installed Cisco client in Programs and Features, select Properties, and view the Version field. Alternatively, open a command prompt and run 'vpnclient.exe version' from the Cisco client installation directory (typically C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\ or C:\Program Files\Cisco\Cisco Secure Client\)Affected if Version is below 4.10.07061 for AnyConnect or below 5.0.02075 for Cisco Secure Client
-
Verify client update functionality is configuredOpen the Cisco AnyConnect or Cisco Secure Client GUI, go to Preferences, and check if 'Allow Cisco to automatically update my client' or similar auto-update settings are enabled. This can also be checked in the client profile XML configuration filesAffected if Auto-update is enabled - this is the vulnerable component that creates the improperly permissioned temp directory
-
Inspect temporary directory used by client updateDuring or after a VPN connection (which triggers the update check), examine the Windows Temp folder (%TEMP%) or the client installation directory for newly created subdirectories with a name pattern related to 'Update' or 'Installer'. Right-click the folder, go to Properties, then Security tab to view permissionsAffected if The temporary update directory grants low-privileged users write or modify access beyond what is intended
A system is affected if Cisco AnyConnect Secure Mobility Client or Cisco Secure Client for Windows is installed with a version lower than 4.10.07061 or 5.0.02075 respectively, and the client auto-update feature is enabled, allowing creation of a vulnerable temporary directory with improper permissions.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped4.10.070615.0.02075
Apply the vendor patch from Cisco when available; until then, restrict local user access to systems running the vulnerable client and monitor for any unauthorized privilege escalation attempts.
Cisco AnyConnect Secure Mobility Client 4.10.07061+ or Cisco Secure Client 5.0.02075+
- 1. Identify the currently installed version of Cisco AnyConnect Secure Mobility Client or Cisco Secure Client on affected Windows systems
- 2. Download the fixed version from Cisco's official software repository: version 4.10.07061 or later for AnyConnect Secure Mobility Client, or version 5.0.02075 or later for Secure Client
- 3. Establish a VPN connection to trigger the client update process, or manually deploy the upgrade via your organization's software distribution system
- 4. Verify the upgrade completed successfully by checking the new client version in Programs and Features or via the CLI: vpncli.exe or anyconnect.exe --version
- 5. Confirm the temporary directory permissions issue is resolved by validating that the %TEMP% or client-specific temp directories used during update no longer allow low-privileged users to modify content
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Anyconnect Secure Mobility Client
Scoped from the published advisory
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-20178 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-20178 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data