Cisco Secure Client for Linux Vulnerability Could Lead to Elevated Privileges
CVE-2024-20338

7.3HIGH

Key Information:

Vendor

Cisco
Status
Cisco Secure Client
Vendor
CVE Published:
6 March 2024

Badges

📰 News Worthy

What is CVE-2024-20338?

A vulnerability exists in the ISE Posture (System Scan) module of Cisco Secure Client for Linux, enabling an authenticated local attacker to elevate privileges on the affected device. This vulnerability arises from the use of an uncontrolled search path element. An attacker can exploit the vulnerability by placing a malicious library file in a specific filesystem directory and convincing an administrator to restart a vulnerable process. This exploit can lead to the execution of arbitrary code with root privileges, providing the attacker with unauthorized access and control over the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Cisco Secure Client

News Articles

favicon imageSpiceworks

Cisco Patches VPN Hijacking Bug - Spiceworks

Cisco has released patches for a critical vulnerability that enabled VPN hijacking in its Secure Client software. Find out more.

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by Spiceworks

  • Vulnerability published

  • Vulnerability Reserved

JSON
.