CVE-2021-1280: 
Cisco Secure Endpoint vulnerability analysis and mitigation

A vulnerability in the loading mechanism of specific DLLs of Cisco Advanced Malware Protection (AMP) for Endpoints for Windows and Immunet for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. The vulnerability, identified as CVE-2021-1280, requires valid credentials on the Windows system for exploitation. This vulnerability was discovered and disclosed in January 2021, affecting all Cisco AMP for Endpoints for Windows releases earlier than Release 7.3.3 and all Immunet for Windows releases earlier than Release 7.3.12 (Cisco Advisory).

The vulnerability is due to incorrect handling of directory search paths at runtime. The issue has been assigned a CVSS base score of 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-427 (Cisco Advisory).

A successful exploit could allow the attacker to execute arbitrary code on the targeted system with SYSTEM privileges. The vulnerability affects Windows-based systems running vulnerable versions of Cisco AMP for Endpoints or Immunet (Cisco Advisory).

An attacker could exploit this vulnerability by placing a malicious DLL file on the targeted system. The file will execute when the vulnerable application launches. The exploitation requires local access and valid credentials on the Windows system. As of the advisory's publication, Cisco PSIRT was not aware of any malicious use of this vulnerability (Cisco Advisory).

Cisco has released software updates that address this vulnerability in Cisco AMP for Endpoints for Windows releases 7.3.3 and later, and Immunet for Windows releases 7.3.12 and later. There are no workarounds available for this vulnerability (Cisco Advisory).