Is CVE-2020-3433 actively exploited?

Yes. CVE-2020-3433 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2020-3433 be exploited remotely?

The attack vector of CVE-2020-3433 has not been classified yet.

What is the CVSS score of CVE-2020-3433?

CVE-2020-3433 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2020-3433

HIGHCISA KEVIN THE WILD

CVE-2020-3433

Published: October 24, 2022

EPSS:4.46%probability of exploitation in 30 daysPercentile:88.9th

Official Description

Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.

NVD Source

CISA KEV Advisory

Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

Added to KEV: 2022-10-24Federal patch deadline: 2022-11-14⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

The Cisco AnyConnect Secure Mobility Client for Windows has an insufficient validation vulnerability in its interprocess communication (IPC) channel. This allows an authenticated attacker with valid Windows credentials to execute code with SYSTEM privileges. Its inclusion in CISA's KEV catalog and an EPSS score of 0.04462 indicate a significant and urgent risk of active exploitation.

This vulnerability is actively exploited in the wild, as confirmed by its presence in CISA's KEV catalog. Exploitation requires local authenticated access.

Recommended Action

Users of Cisco AnyConnect Secure Mobility Client for Windows should update to a patched version to address the IPC channel vulnerability. Ensure all systems have the latest security updates.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2020-3433 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2020-3433 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.