CVE-2023-20178

CVE-2023-20178 is a privilege escalation vulnerability affecting Cisco AnyConnect Secure Mobility Client and Cisco Secure Client for Windows. It allows a low-privileged, authenticated local attacker to gain SYSTEM privileges due to improper permissions on a temporary update directory. With a CVSS score of 7.8 (HIGH), this vulnerability is easily exploitable with low attack complexity and no user interaction required, leading to full compromise of confidentiality, integrity, and availability. While not yet in CISA's KEV catalog, public exploit code exists, and it has garnered significant community discussion and media coverage, indicating a high potential for future exploitation.