← Back

CVE-2024-20391

nvd nist
Published: May 15, 2024Modified: Jul 22, 2025

JSON object

Loading...
6.8
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.9 / Impact: 5.9
Source: psirt@cisco.com (Secondary)

Description

A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM. This vulnerability is due to a lack of authentication on a specific function. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges on an affected device.

Affected (1)

Products: Cisco: Secure Client
Cisco
1 product
Secure Client
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Secure Client
Before 5.1.3.62
Running on/withPlatform Versions
Microsoft
Windows
All versions

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: psirt@cisco.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.