CVE-2021-1237

CVE-2021-1237 is a DLL injection vulnerability affecting the Network Access Manager and Web Security Agent components of Cisco AnyConnect Secure Mobility Client for Windows. An authenticated, local attacker can exploit this by inserting a malicious configuration file, leading to arbitrary code execution with SYSTEM privileges. With a CVSS score of 7.8 (High), this vulnerability requires local access and valid credentials, but its impact is significant. There is no evidence of active exploitation, public exploit code, or inclusion in CISA's KEV catalog, though it has received minimal community discussion and media coverage.