March 12, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – DanaBot Trojan – Active IOCs
June 17, 2021Rewterz Threat Advisory – Cisco DNA Center Certificate Validation Vulnerability
June 17, 2021Rewterz Threat Alert – DanaBot Trojan – Active IOCs
June 17, 2021Rewterz Threat Advisory – Cisco DNA Center Certificate Validation Vulnerability
June 17, 2021
Severity
High
Analysis Summary
CVE-2021-1567
A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. An attacker could exploit this vulnerability by sending a series of crafted interprocess communication (IPC) messages to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected device with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid credentials on the Windows system.
CVE-2021-1568
A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. An attacker could exploit this vulnerability by copying a crafted file to a specific folder on the system. A successful exploit could allow the attacker to crash the VPN Agent service when the affected application is launched, causing it to be unavailable to all users of the system. To exploit this vulnerability, the attacker must have valid credentials on a multiuser Windows system.
Impact
- Code Execution
- Denial of Service
- Unauthorized Access
Affected Vendors
Cisco
Affected Products
- Cisco AnyConnect Secure Mobility Client for Windows releases earlier than Release 4.10.01075
Remediation
Refer to Cisco advisory for the complete list of affected product and their respective patches.