VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jan 13, 2021· Updated Jun 17, 2026

CVE-2021-1258

CVE-2021-1258

Description

A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient file permission restrictions. An attacker could exploit this vulnerability by sending a crafted command from the local CLI to the application. A successful exploit could allow the attacker to read arbitrary files on the underlying OS of the affected device. The attacker would need to have valid user credentials to exploit this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Cisco Systems, Inc./Anyconnect Secure Mobility Client5 versions
    cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:linux_kernel:*:*+ 4 more
    • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:linux_kernel:*:*range: <4.9.03047
    • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:macos:*:*range: <4.9.03047
    • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:windows:*:*range: <4.9.03049
    • (no CPE)
    • (no CPE)range: n/a
  • McAfee/Agent Epolicy Orchestrator Extension
    cpe:2.3:a:mcafee:agent_epolicy_orchestrator_extension:*:*:*:*:*:*:*:*
    Range: <5.7.6

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.