Out-of-bounds read in Cisco Secure Client
Priority LOW 24CWE-125Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software. An attacker could exploit these vulnerabilities by logging in to an affected device at the same time that another user is accessing Cisco Secure Client on the same system, and then sending crafted packets to a port on that local host. A successful exploit could allow the attacker to crash the VPN Agent service, causing it to be unavailable to all users of the system. To exploit these vulnerabilities, the attacker must have valid credentials on a multi-user system.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00197 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Secure Client | 4.9.00086; 4.9.01095; 4.9.02028; 4.9.03047; 4.9.03049; 4.9.04043; 4.9.04053; 4.9.05042; 4.9.06037; 4.10.00093; 4.10.01075; 4.10.02086; 4.10.03104; 4.10.04065; 4.10.04071; 4.10.05085; 4.10.05095; 4.10.05111; 4.10.06079; 4.10.06090; 4.10.07061; 4.10.07062; 4.10.07073; 5.0.00238; 5.0.00529; 5.0.00556; 5.0.01242; 5.0.02075; 5.0.03072; 5.0.03076 | — | No fix listed | CNA |
- Cisco Secure Client VendorCisco Affected 4.9.00086; 4.9.01095; 4.9.02028; 4.9.03047; 4.9.03049; 4.9.04043; 4.9.04053; 4.9.05042; 4.9.06037; 4.10.00093; 4.10.01075; 4.10.02086; 4.10.03104; 4.10.04065; 4.10.04071; 4.10.05085; 4.10.05095; 4.10.05111; 4.10.06079; 4.10.06090; 4.10.07061; 4.10.07062; 4.10.07073; 5.0.00238; 5.0.00529; 5.0.00556; 5.0.01242; 5.0.02075; 5.0.03072; 5.0.03076 Fixed in — No fix listed CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.00086:*:*:*:*:*:*:* | 4.9.00086 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.01095:*:*:*:*:*:*:* | 4.9.01095 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.02028:*:*:*:*:*:*:* | 4.9.02028 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.03047:*:*:*:*:*:*:* | 4.9.03047 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.03049:*:*:*:*:*:*:* | 4.9.03049 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.04043:*:*:*:*:*:*:* | 4.9.04043 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.04053:*:*:*:*:*:*:* | 4.9.04053 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.05042:*:*:*:*:*:*:* | 4.9.05042 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.06037:*:*:*:*:*:*:* | 4.9.06037 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.00093:*:*:*:*:*:*:* | 4.10.00093 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.00086:*:*:*:*:*:*:* Versions 4.9.00086 Vulnerable ·Cisco
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.01095:*:*:*:*:*:*:* Versions 4.9.01095 Vulnerable ·Cisco
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.02028:*:*:*:*:*:*:* Versions 4.9.02028 Vulnerable ·Cisco
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.03047:*:*:*:*:*:*:* Versions 4.9.03047 Vulnerable ·Cisco
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.03049:*:*:*:*:*:*:* Versions 4.9.03049 Vulnerable ·Cisco
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.04043:*:*:*:*:*:*:* Versions 4.9.04043 Vulnerable ·Cisco
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.04053:*:*:*:*:*:*:* Versions 4.9.04053 Vulnerable ·Cisco
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.05042:*:*:*:*:*:*:* Versions 4.9.05042 Vulnerable ·Cisco
- cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.9.06037:*:*:*:*:*:*:* Versions 4.9.06037 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.00093:*:*:*:*:*:*:* Versions 4.10.00093 Vulnerable ·Cisco
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:secure_client:4.10.01075:*:*:*:*:*:*:* | 4.10.01075 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.02086:*:*:*:*:*:*:* | 4.10.02086 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.03104:*:*:*:*:*:*:* | 4.10.03104 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.04065:*:*:*:*:*:*:* | 4.10.04065 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.04071:*:*:*:*:*:*:* | 4.10.04071 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.05085:*:*:*:*:*:*:* | 4.10.05085 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.05095:*:*:*:*:*:*:* | 4.10.05095 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.05111:*:*:*:*:*:*:* | 4.10.05111 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.06079:*:*:*:*:*:*:* | 4.10.06079 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.06090:*:*:*:*:*:*:* | 4.10.06090 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.07061:*:*:*:*:*:*:* | 4.10.07061 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.07062:*:*:*:*:*:*:* | 4.10.07062 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:4.10.07073:*:*:*:*:*:*:* | 4.10.07073 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:5.0.00238:*:*:*:*:*:*:* | 5.0.00238 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:5.0.00529:*:*:*:*:*:*:* | 5.0.00529 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:5.0.00556:*:*:*:*:*:*:* | 5.0.00556 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:5.0.01242:*:*:*:*:*:*:* | 5.0.01242 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:5.0.02075:*:*:*:*:*:*:* | 5.0.02075 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:5.0.03072:*:*:*:*:*:*:* | 5.0.03072 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_client:5.0.03076:*:*:*:*:*:*:* | 5.0.03076 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:secure_client:4.10.01075:*:*:*:*:*:*:* Versions 4.10.01075 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.02086:*:*:*:*:*:*:* Versions 4.10.02086 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.03104:*:*:*:*:*:*:* Versions 4.10.03104 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.04065:*:*:*:*:*:*:* Versions 4.10.04065 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.04071:*:*:*:*:*:*:* Versions 4.10.04071 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.05085:*:*:*:*:*:*:* Versions 4.10.05085 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.05095:*:*:*:*:*:*:* Versions 4.10.05095 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.05111:*:*:*:*:*:*:* Versions 4.10.05111 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.06079:*:*:*:*:*:*:* Versions 4.10.06079 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.06090:*:*:*:*:*:*:* Versions 4.10.06090 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.07061:*:*:*:*:*:*:* Versions 4.10.07061 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.07062:*:*:*:*:*:*:* Versions 4.10.07062 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:4.10.07073:*:*:*:*:*:*:* Versions 4.10.07073 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:5.0.00238:*:*:*:*:*:*:* Versions 5.0.00238 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:5.0.00529:*:*:*:*:*:*:* Versions 5.0.00529 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:5.0.00556:*:*:*:*:*:*:* Versions 5.0.00556 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:5.0.01242:*:*:*:*:*:*:* Versions 5.0.01242 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:5.0.02075:*:*:*:*:*:*:* Versions 5.0.02075 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:5.0.03072:*:*:*:*:*:*:* Versions 5.0.03072 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_client:5.0.03076:*:*:*:*:*:*:* Versions 5.0.03076 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-20240
- 2026-10-03 Alias added: GHSA-qwhq-2jqj-q642
References
Advisory 1
More Cisco Anyconnect Secure Mobility Client vulnerabilities
- TI-2020-02982 Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2020-02715 Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability KEVCVSS 3.1MEDIUM 6.5
- TI-2011-01789 The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect… CVSS 2.0HIGH 7.6
- TI-2011-01790 The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect… CVSS 2.0HIGH 9.3
- TI-2012-02179 The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure… CVSS 2.0HIGH 9.3
- TI-2023-06884 Incorrect default permissions in Cisco Secure Client CVSS 3.1HIGH 7.8
Sources
- CVE-2023-20240 · CVE Program
- CVE-2023-20240 · NVD
- FIRST EPSS
- GHSA-qwhq-2jqj-q642 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences