CVE-2024-20391
A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM.
Description
A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM. This vulnerability is due to a lack of authentication on a specific function. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges on an affected device.
Weakness: CWE-306
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Secure Client (AnyConnect) | VPN & Remote Access | cna-assigner |
Vendor-reported products (38)
- Cisco · Cisco Secure Client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
- cisco · secure_client
Vendor advisory
cisco-sa-secure-nam-priv-esc-szu2vYpZ
Cisco Secure Client for Windows with Network Access Manager Module Privilege Escalation Vulnerability
Cisco’s rating: Medium (advisory CVSS 6.8) · Published May 15, 2024
Bug ID: CSCwj48522
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from