CVE-2021-1258: 
Cisco AnyConnect Secure Client vulnerability analysis and mitigation

CVE-2021-1258 is a vulnerability discovered in the upgrade component of Cisco AnyConnect Secure Mobility Client. The vulnerability was first published on January 13, 2021, and affects multiple versions of the AnyConnect Secure Mobility Client across Linux, MacOS, and Windows platforms. The issue stems from insufficient file permission restrictions in the application (Cisco Advisory).

The vulnerability is characterized by insufficient file permission restrictions in the upgrade component. It has been assigned a CVSS base score of 5.5 with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:X/RL:X/RC:X, indicating a medium severity level. The vulnerability is classified under CWE-264 (Cisco Advisory).

A successful exploitation of this vulnerability could allow an authenticated, local attacker with low privileges to read arbitrary files on the underlying operating system of an affected device. The attacker would need valid user credentials to exploit this vulnerability (Cisco Advisory).

The Cisco Product Security Incident Response Team (PSIRT) confirmed that proof-of-concept exploit code is available for this vulnerability. However, as of February 23, 2021, there were no known instances of malicious exploitation in the wild. The vulnerability can be exploited by sending a crafted command from the local CLI to the application (Cisco Advisory).

Cisco has released software updates to address this vulnerability. The fixed versions include AnyConnect Secure Mobility Client for Linux and MacOS releases 4.9.03047 and later, and Windows releases 4.9.03049 and later. No workarounds are available for this vulnerability, and customers are advised to contact the Cisco Technical Assistance Center (TAC) for possible mitigation strategies (Cisco Advisory).

The vulnerability was responsibly disclosed by Michael Henry of Facebook to Cisco. The disclosure and patching process followed standard industry practices, with Cisco releasing both initial advisory and update confirmations about the availability of proof-of-concept code (Cisco Advisory).