{"uuid": "24b540f3-979f-4109-98e8-44be1657f96a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-20178", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/106867", "content": "Black Hat Ethical Hacking\nCisco Secure Client Software for Windows Vulnerable to Privilege Escalation Attack\n\nCisco Secure Client Software for Windows Vulnerable to Privilege Escalation AttackPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA high-severity vulnerability has been discovered in Cisco Secure Client Software for Windows (formerly AnyConnect Secure Mobility Client), which could allow attackers to elevate privileges to the SYSTEM account. This software enables secure Virtual Private Network (VPN) connections for remote work and provides network administrators with endpoint management features and telemetry.\n\nTracked as CVE-2023-20178, the vulnerability allows authenticated threat actors to escalate privileges to the Windows operating system\u2019s SYSTEM account through low-complexity attacks that do not require user interaction. Exploitation involves abusing a specific function of the Windows installer process.\n\nCisco has released security updates to address this flaw, stating that there is no evidence of active exploitation or public exploit code targeting the vulnerability at present. The fix is included in the latest versions of AnyConnect Secure Mobility Client for Windows (4.10MR7) and Cisco Secure Client for Windows (5.0MR2).\n\nhttps://www.bleepstatic.com/images/news/u/1109292/2023/Escalating%20privileges%20to%20SYSTEM.PNG Escalating privileges to SYSTEM using the\u00a0CVE-2023-20178 PoC exploit\u00a0(Filip Dragovi\u0107)\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nRecently, security researcher Filip Dragovi\u0107 discovered and reported the Arbitrary File Delete vulnerability to Cisco and published proof-of-concept (PoC) exploit code earlier this week. The PoC was tested against Cisco Secure Client (version 5.0.01242) and Cisco AnyConnect (version 4.10.06079).\n\nThe vulnerability arises when the vpndownloader.exe process is initiated in the background upon connecting to the VPN. It creates a directory in \u201cc:\\windows\\temp\u201d with default permissions in a specific format. The researcher explains that by exploiting this behavior, an attacker can delete arbitrary files as the NT Authority\\SYSTEM account.\nTrending: Unlocking Windows System Resource Utilization for Digital Forensics Analysis with SRUM Dump Trending: Offensive Security Tool: PhoneSploit Pro The attacker can then escalate privileges by spawning a SYSTEM shell through arbitrary file deletion, leveraging the Windows installer behavior and the execution of a client update process after a successful VPN connection.\n\nThis incident serves as a reminder of the importance of promptly patching software vulnerabilities. In the past, Cisco has addressed other security flaws in AnyConnect, some of which were actively exploited in attacks. Users are advised to keep their software up to date to mitigate potential risks.\nTrending: Chinese Hacking Group Exploits VMware ESXi Vulnerability to Backdoor Windows and Linux VMs Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/Images-for-the-News-posts-35-300x150.png Brute-Force Attack on Linux SSH Servers Unleashes Tsunami DDoS BotJune 21, 2023\n* https://[...]", "creation_timestamp": "2026-09-04T13:00:04.368309Z"}