Local Privilege Escalation Vulnerability in Cisco VPN Client for Windows

CVE-2007-4415

Summary

The Cisco VPN Client for Windows prior to version 5.0.01.0600 includes weak permissions for the cvpnd.exe executable, granting Modify access to Interactive Users. This weakness can be exploited by local users, allowing them to elevate their privileges by modifying the cvpnd.exe file. It is crucial for users and administrators to ensure they implement proper access controls and update to the latest version to mitigate this risk.

References