CVE-2016-9192
Estado: ModificadaAlta (7.8)—💥 PoC
A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. More Information: CSCvb68043. Known Affected Releases: 4.3(2039) 4.3(748). Known Fixed Releases: 4.3(4019) 4.4(225).
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 3.47%
- Percentil entre todas las CVEs puntuadas: 89
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Prueba de concepto en GitHub (no verificada) · Lista de pruebas de concepto en GitHub
⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.
Tecnologías afectadas (1)
CWE
- CWE-264
Referencias
- http://www.securityfocus.com/bid/94770
- http://www.securitytracker.com/id/1037409
- https://github.com/nettitude/PoshC2/blob/master/Modules/CVE-2016-9192.ps1
- https://github.com/serializingme/cve-2016-9192
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-anyconnect1
- http://www.securityfocus.com/bid/94770
- http://www.securitytracker.com/id/1037409
- https://github.com/nettitude/PoshC2/blob/master/Modules/CVE-2016-9192.ps1
- https://github.com/serializingme/cve-2016-9192
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-anyconnect1
JSON original (NVD)
Mostrar
{
"id": "CVE-2016-9192",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.2,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "n/a",
"product": "Cisco AnyConnect Secure Mobility Client",
"versions": [
{
"status": "affected",
"version": "Cisco AnyConnect Secure Mobility Client"
}
]
}
]
}
],
"published": "2016-12-14T00:59:15.223",
"references": [
{
"url": "http://www.securityfocus.com/bid/94770",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "psirt@cisco.com"
},
{
"url": "http://www.securitytracker.com/id/1037409",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "psirt@cisco.com"
},
{
"url": "https://github.com/nettitude/PoshC2/blob/master/Modules/CVE-2016-9192.ps1",
"source": "psirt@cisco.com"
},
{
"url": "https://github.com/serializingme/cve-2016-9192",
"source": "psirt@cisco.com"
},
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-anyconnect1",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
},
{
"url": "http://www.securityfocus.com/bid/94770",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1037409",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/nettitude/PoshC2/blob/master/Modules/CVE-2016-9192.ps1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/serializingme/cve-2016-9192",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-anyconnect1",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. More Information: CSCvb68043. Known Affected Releases: 4.3(2039) 4.3(748). Known Fixed Releases: 4.3(4019) 4.4(225)."
},
{
"lang": "es",
"value": "Una vulnerabilidad en Cisco AnyConnect Secure Mobility Client para Windows podría permitir a un atacante local autenticado instalar y ejecutar un archivo ejecutable con privilegios equivalentes a la cuenta SYSTEM del sistema operativo Microsoft Windows. Más Información: CSCvb68043. Lanzamientos Afectados Conocidos: 4.3(2039) 4.3(748). Lanzamientos Reparados Conocidos: 4.3(4019) 4.4(225)."
}
],
"lastModified": "2026-06-17T00:55:39.490",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1\\(60\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B415C06-7A2B-4CDC-B7DD-12FF22DB466F"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CFE1E12-CAEE-4CB5-8969-D6F92451F69B"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.02043:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "871452CA-054B-411F-AC5F-78C7F666D813"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.05182:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E12D9394-B33E-4292-9FF1-E405AF1781B0"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.05187:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54D06E2E-6CBC-40D4-9409-030822552A45"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.06073:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB28D6B8-C1AC-49E6-9753-7E4703CB73A9"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.07021:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "217290C9-A508-4253-B807-E5E605A2D990"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0\\(48\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0BFC839F-D9E1-4B41-B316-8FF44FDAFC78"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0\\(64\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9EC1592B-04DE-4FBB-88EF-7AFADEE75624"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0\\(2049\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28E79966-4EE3-4987-AB0C-FEC2DD713012"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3782E3EC-B35A-443E-B9CF-5EA8B2D0F732"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00048:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0608CACF-28C5-4A23-81FE-7FEB655FC84B"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00051:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "72B9DB6D-0ABC-4938-A36E-2F68AB94635C"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1\\(8\\):*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8B34FCE-31B0-47F1-80D9-4AF8E8584EF1"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACBB4489-1C7C-4435-AF21-ADBA57F49C19"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E6A4023A-A8D3-47A7-98A4-4B8F47E1085C"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.04039:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DDD9910A-4609-41B3-97E2-FF1366559C1E"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11C45A3D-8EF2-428B-A154-740EF5704058"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.00748:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D5C7873-878D-48C4-9461-9B112701DAF0"
},
{
"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.01095:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55AE035D-DA9A-4894-A838-DA9266E3859F"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@cisco.com"
}