Out-of-bounds read in Cisco Systems, Inc products - CVE-2023-20240

Vulnerability identifier: #VU83235

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20240

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a enial of service (DoS) attack.

The vulnerability exists due to a boundary condition. A local user can trigger an out-of-bounds read error and cause a denial of service condition on the system.

Cisco AnyConnect Secure Mobility Client
Cisco Secure Client AnyConnect VPN for iOS
Secure Client AnyConnect for Android
Cisco Secure Client AnyConnect for Universal Windows Platform
Cisco Secure Client for Linux
Cisco Secure Client for MacOS

Install updates from vendor's website.

Cisco AnyConnect Secure Mobility Client - addressed in versions 4.10 MR8, 5.0 MR4 5.0.04032, 5.0 MR5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-accsc-dos-9SLzkZ8

• Multiple vulnerabilities in Cisco Secure Client Software