CERT-In cautions users about vulnerabilities in Cisco's VPN client

Dual vulnerability

Two vulnerabilities exist in Cisco AnyConnect. The CERT-In termed the first vulnerability as DLL Hijacking Vulnerability.

The vulnerability exists in AnyConnect's interprocess communication channel in this case. An interprocess communication channel is a mechanism that allows processes to communicate with one another and synchronise their actions.

"An attacker with valid access credentials on the system could exploit this vulnerability by sending a specially crafted interprocess message to the AnyConnect process," the advisory read.

An attacker can then execute arbitrary code on the system.

The second vulnerability is called Uncontrolled Search Path Vulnerability.

"This vulnerability exists in the installer component of Anyconnect for Windows due to an error while handling directory paths," the advisory read.

Similar to the first vulnerability, this vulnerability can be exploited by creating malicious files and copying them to the system directory.

"It is to be noted that these vulnerabilities are being exploited in the wild. An attacker could exploit these vulnerabilities in conjunction with other Windows privilege escalation flaws to conduct further attacks on the target system," the CERT-In added.

To mitigate these vulnerabilities, the agency urged users to apply the updates available on Cisco's website.

Earlier in June, Malaysia-based DragonForceIO targeted two Indian corporate VPNs and websites of Mumbai University and Thane city police. This was in response to comments against Prophet Mohammad.

Cybernetyx VPN and Logixal VPN were allegedly compromised by hackers. They also shared login credentials with designated IP addresses associated with the two corporate VPNs. In addition, they provided screenshots to corroborate their claims.

Later Logixal, which provides e-banking solutions, clarified to Moneycontrol that customer data was not affected due to the breach and that they were conducting further investigation.