Cisco AnyConnect Secure Mobility Client for Windows Denial of Service Vulnerability

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process on an affected device. A successful exploit could allow the attacker to stop the AnyConnect process, causing a DoS condition on the device. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

输入验证不恰当

Cisco AnyConnect Secure Mobility Client 输入验证错误漏洞

Cisco AnyConnect Secure Mobility Client for Windows是美国思科（Cisco）公司的一款基于Windows平台的可通过任何设备安全访问网络和应用的安全移动客户端。 基于Windows平台的Cisco AnyConnect Secure Mobility Client 4.9.00086及之前版本中的IPC通道存在输入验证错误漏洞，该漏洞源于程序没有充分验证用户提交的输入。本地攻击者可通过发送特制的IPC消息利用该漏洞造成拒绝服务。

N/A

N/A