CVE-2020-3434: 
Cisco AnyConnect Secure Client vulnerability analysis and mitigation

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows was discovered and assigned CVE-2020-3434. The vulnerability, disclosed on August 17, 2020, affects versions up to and including 4.9.00086. This security flaw allows an authenticated, local attacker with valid Windows system credentials to cause a denial of service (DoS) condition on affected devices (NVD).

The vulnerability stems from insufficient validation of user-supplied input in the IPC channel. It has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-20 (Improper Input Validation) (NVD).

A successful exploitation of this vulnerability could allow an attacker to stop the AnyConnect process, resulting in a denial of service (DoS) condition on the affected device. The impact is limited to service availability, with no compromise to confidentiality or integrity (NVD).

To exploit this vulnerability, an attacker needs to have valid credentials on the Windows system and must be able to send a crafted IPC message to the AnyConnect process on the affected device. The vulnerability has been successfully tested against multiple versions of Cisco AnyConnect Secure Mobility Client, including versions 4.5.02036, 4.6.03049, 4.7.04056, 4.8.01090, and 4.8.03052 on Windows 10 version 1909 (x64) and version 4.7.4056 on Windows 7 SP1 (x64) (Rapid7).

The vulnerability was addressed in Cisco AnyConnect Secure Mobility Client for Windows version 4.9.00086. Organizations are advised to upgrade to a fixed version to mitigate this security risk (NVD).