CVE-2023-20240

CVSS 3.1 Score 5.5 of 10 (medium)

Details

Published Nov 22, 2023
Updated: Jan 25, 2024
CWE ID 125

Summary

CVE-2023-20240 is a vulnerability that affects Cisco Secure Client Software, formerly known as AnyConnect Secure Mobility Client. It allows an authenticated, local attacker to cause a denial of service (DoS) condition on the affected system by exploiting out-of-bounds memory read vulnerabilities. The attacker can accomplish this by logging in to the device while another user is accessing Cisco Secure Client on the same system and sending crafted packets to a port on the local host. This vulnerability requires the attacker to have valid credentials on a multi-user system. The potential danger posed by this vulnerability is that it can crash the VPN Agent service, rendering it unavailable to all users of the system. To remediate this vulnerability, organizations should apply any available patches or updates provided by Cisco.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-20240 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options