CVE-2021-1366: 
Cisco AnyConnect Secure Client vulnerability analysis and mitigation

A vulnerability (CVE-2021-1366) was discovered in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module. The vulnerability affects releases earlier than 4.9.05042 and is due to insufficient validation of resources that are loaded by the application at run time (Cisco Advisory).

The vulnerability is classified as a DLL hijacking attack vulnerability with a CVSS base score of 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue stems from insufficient validation of resources loaded by the application at runtime, specifically in the IPC channel of the application (Cisco Advisory).

A successful exploitation could allow an authenticated, local attacker to execute arbitrary code with SYSTEM privileges on the affected machine. The attacker needs valid credentials on the Windows system to exploit this vulnerability (Cisco Advisory).

The vulnerability requires an attacker to have valid credentials on the Windows system and the ability to send crafted IPC messages to the AnyConnect process. As of the advisory publication, Cisco PSIRT was not aware of any public announcements or malicious use of this vulnerability (Cisco Advisory).

Cisco has released software updates that address this vulnerability in Cisco AnyConnect Secure Mobility Client for Windows releases 4.9.05042 and later. There are no workarounds available for this vulnerability (Cisco Advisory).