Cisco: Known AnyConnect Vulnerabilities are Being Actively Exploited

Cisco is warning that two previously disclosed vulnerabilities in its AnyConnect Secure Mobility Client for Windows are being actively exploited. Cisco released fixes for the vulnerabilities in February and August 2020. Both vulnerabilities have been added to the US Cybersecurity and Infrastructure Security Agency’s (CISA’s) Known Exploited Vulnerabilities catalog.

Note

• The good news is this only impacts your Windows client. The bad news is probably most of your clients are Windows-based. There are no workarounds: you need to get your clients to at least 4.9.00086. Use the firewall’s capability to update the client to push an update when users next connect. Consider using your endpoint management to also distribute the updated client. POC exploit code was available 8/13, and Cisco became aware of active exploitation attempts 10/25. CISA is giving agencies until 11/14 to fix this. I’d advise not waiting.
• It’s rather odd that these two LPEs are being actively exploited years after they are released. It is also probably not surprising as many customers are reluctant to upgrade their versions of AnyConnect unless there is a specific feature needed, such as “Windows 11” support. As of the time of the publishing of this, it’s important to note that the DarkReading article mentions a Cisco Gigabyte Driver, which I believe is a mistake. Cisco doesn’t own Gigabyte. I believe they are referring to the motherboard manufacturer being added to the CISA KEV.

Read more in

• Cisco Warns AnyConnect VPNs Under Active Cyberattack
• Cisco AnyConnect Windows client under active attack
• Cisco warns admins to patch AnyConnect flaws exploited in attacks
• Cisco Security Advisories
• Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
• Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability