PT-2020-1643 · Cisco · Cisco Anyconnect Secure Mobility Client

Huan Chang · Published 2020-01-08 · Updated 2020-09-28 · CVE-2019-16007

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client versions (affected versions not specified)

Description The issue is related to insufficient authentication of data in the Cisco AnyConnect Secure Mobility Client, which could allow an unauthenticated, local attacker to perform a service hijack attack or cause a denial of service (DoS) condition. This is due to the use of implicit service invocations. An attacker could exploit this by persuading a user to install a malicious application, potentially accessing confidential user information or causing a DoS condition on the AnyConnect application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2020-00872

CVE-2019-16007

Affected Products

Cisco Anyconnect Secure Mobility Client

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-anyconnect-hijack · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16007 · Security Note
• https://bdu.fstec.ru/vul/2020-00872 · Security Note
• https://t.me/cibsecurity/14832 · Telegram Post