TI-2023-06884 Aliases CVE-2023-20178 GHSA-6rj9-hcv7-94r5

Incorrect default permissions in Cisco Secure Client

MEDIUM 44CWE-276Published 2023-06-28 · Updated 2026-10-08

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established. This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.05374 92nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco Secure Client	4.9.00086; 4.9.01095; 4.9.02028; 4.9.03047; 4.9.03049; 4.9.04043; 4.9.04053; 4.9.05042; 4.9.06037; 4.10.00093; 4.10.01075; 4.10.02086; 4.10.03104; 4.10.04065; 4.10.04071; 4.10.05085; 4.10.05095; 4.10.05111; 4.10.06079; 4.10.06090; 5.0.00238; 5.0.00529; 5.0.00556; 5.0.01242	—	No fix listed	CNA

Cisco Secure Client VendorCisco Affected 4.9.00086; 4.9.01095; 4.9.02028; 4.9.03047; 4.9.03049; 4.9.04043; 4.9.04053; 4.9.05042; 4.9.06037; 4.10.00093; 4.10.01075; 4.10.02086; 4.10.03104; 4.10.04065; 4.10.04071; 4.10.05085; 4.10.05095; 4.10.05111; 4.10.06079; 4.10.06090; 5.0.00238; 5.0.00529; 5.0.00556; 5.0.01242 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:anyconnect_secure_mobility_client::::::windows::*	before 4.10.07061	Vulnerable	Cisco
cpe:2.3:a:cisco:secure_client::::::windows::*	before 5.0.02075	Vulnerable	Cisco

cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:windows:*:* Versions before 4.10.07061 Vulnerable ·Cisco
cpe:2.3:a:cisco:secure_client:*:*:*:*:*:windows:*:* Versions before 5.0.02075 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-20178
2026-10-03 Alias added: GHSA-6rj9-hcv7-94r5
2026-10-08 CISA SSVC decision points changed

References

Advisory 1

cisco-sa-ac-csc-privesc-wx4U4Kw

TI-2020-02982 Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability KEVCVSS 3.1HIGH 7.8
TI-2020-02715 Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability KEVCVSS 3.1MEDIUM 6.5
TI-2011-01789 The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect… CVSS 2.0HIGH 7.6
TI-2011-01790 The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect… CVSS 2.0HIGH 9.3
TI-2012-02179 The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure… CVSS 2.0HIGH 9.3
TI-2012-02654 Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check… CVSS 2.0HIGH 9.3

See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences