Vulnerabilities > CVE-2024-20474 - Integer Underflow (Wrap or Wraparound) vulnerability in Cisco Anyconnect Secure Mobility Client and Secure Client

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

cisco

CWE-191

NVD

Published: 2024-10-23

Updated: 2024-11-01

Summary

A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of Cisco Secure Client. This vulnerability is due to an integer underflow condition. An attacker could exploit this vulnerability by sending a crafted IKEv2 packet to an affected system. A successful exploit could allow the attacker to cause Cisco Secure Client Software to crash, resulting in a DoS condition on the client software. Note: Cisco Secure Client Software releases 4.10 and earlier were known as Cisco AnyConnect Secure Mobility Client.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco Anyconnect Secure Mobility Client 4.9.00086 Cisco Anyconnect Secure Mobility Client 4.9.01095 Cisco Anyconnect Secure Mobility Client 4.9.02028 Cisco Anyconnect Secure Mobility Client 4.9.03047 Cisco Anyconnect Secure Mobility Client 4.9.03049 Cisco Anyconnect Secure Mobility Client 4.9.04043 Cisco Anyconnect Secure Mobility Client 4.9.04053 Cisco Anyconnect Secure Mobility Client 4.9.05042 Cisco Anyconnect Secure Mobility Client 4.9.06037 Cisco Secure Client 4.10.00093 Cisco Secure Client 4.10.01075 Cisco Secure Client 4.10.02086 Cisco Secure Client 4.10.03104 Cisco Secure Client 4.10.04065 Cisco Secure Client 4.10.04071 Cisco Secure Client 4.10.05085 Cisco Secure Client 4.10.05095 Cisco Secure Client 4.10.05111 Cisco Secure Client 4.10.06079 Cisco Secure Client 4.10.06090 Cisco Secure Client 4.10.07061 Cisco Secure Client 4.10.07062 Cisco Secure Client 4.10.07073 Cisco Secure Client 5.0.00238 Cisco Secure Client 5.0.00529 Cisco Secure Client 5.0.00556 Cisco Secure Client 5.0.01242 Cisco Secure Client 5.0.02075 Cisco Secure Client 5.0.03072 Cisco Secure Client 5.0.03076 Cisco Secure Client 5.1.3.62 Cisco Secure Client 5.1.2.42 Cisco Secure Client 5.1.1.42 Cisco Secure Client 5.1.0.136 Cisco Secure Client 5.0.05040 Cisco Secure Client 5.0.04032 Cisco Secure Client 4.10.08029 Cisco Secure Client 4.10.08025	38

Common Weakness Enumeration (CWE)

CWE-191 - Integer Underflow (Wrap or Wraparound)

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csc-dos-XvPhM3bj