Endpoint Protection Evasion in Cisco Secure Endpoint for Windows

CVE-2023-20084

Summary

A vulnerability in Cisco Secure Endpoint for Windows allows an authenticated, local attacker to circumvent endpoint protection by exploiting a timing issue within the software components. The attack requires the user to place a malicious file in a designated folder and execute it within a specific timeframe. If successful, the attacker can prevent the endpoint software from quarantining the malicious file or terminating its process. This issue is particularly concerning for deployments with the Windows Folder Redirection feature enabled.

References