Privilege Escalation in Cisco VPN Client for Windows

CVE-2011-2678

Summary

The Cisco VPN Client versions 5.0.7.0240 and 5.0.7.0290 for 64-bit Windows systems suffer from a vulnerability related to improper file permissions. Specifically, the executable file 'cvpnd.exe' is set with weak permissions that allow local users to replace it with arbitrary programs, effectively enabling them to gain elevated privileges. This issue arises from a regression related to a previously addressed vulnerability and poses a significant risk if exploited.

References