CVE-2017-3813

Status: ModifiedHigh (7.8)—💥 Exploit

A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the access controls. An attacker could exploit this vulnerability by opening the Internet Explorer browser. An exploit could allow the attacker to use Internet Explorer with the privileges of the SYSTEM user. This may allow the attacker to execute privileged commands on the targeted system. This vulnerability affects versions prior to released versions 4.4.00243 and later and 4.3.05017 and later. Cisco Bug IDs: CSCvc43976.

CVSS

Version: 3.0
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base score: 7.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.71%
Percentile among all scored CVEs: 77
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

💥 Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Published on Exploit-DB · Cisco AnyConnect Secure Mobility Client 4.3.04027 - Local Privilege Escalation (2/28/2017)

Affected technologies (1)

Cisco — Anyconnect Secure Mobility Client

CWEs

CWE-264
CWE-862

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2017-3813",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Cisco AnyConnect Secure Mobility Client Software for Windows Versions prior to released versions 4.4.00243 and later and 4.3.05017 and later.",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco AnyConnect Secure Mobility Client Software for Windows Versions prior to released versions 4.4.00243 and later and 4.3.05017 and later."
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-02-09T17:59:00.187",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/96145",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1037796",
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170208-anyconnect",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/41476/",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/96145",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1037796",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170208-anyconnect",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/41476/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the access controls. An attacker could exploit this vulnerability by opening the Internet Explorer browser. An exploit could allow the attacker to use Internet Explorer with the privileges of the SYSTEM user. This may allow the attacker to execute privileged commands on the targeted system. This vulnerability affects versions prior to released versions 4.4.00243 and later and 4.3.05017 and later. Cisco Bug IDs: CSCvc43976."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el módulo Start Before Logon (SBL) de Cisco AnyConnect Secure Mobility Client Software para Windows podría permitir a un atacante local no autenticado abrir Internet Explorer con los privilegios del usuario SYSTEM. Esta vulnerabilidad se debe a implementación insuficiente de los controles de acceso. Un atacante podría explotar esta vulnerabilidad abriendo el navegador de Internet Explorer. Una explotación podría permitir al atacante usar Internet Explorer con privilegios del usuario SYSTEM. Esto podría permitir al atacante ejecutar comandos privilegiados en el sistema objetivo. Esta vulnerabilidad afecta a versiones anteriores a las versiones lanzadas 4.4.00243 y posteriores y 4.3.05017 y posteriores. Cisco Bug IDs: CSCvc43976."
    }
  ],
  "lastModified": "2026-06-17T01:18:58.333",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00048:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0608CACF-28C5-4A23-81FE-7FEB655FC84B"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00051:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72B9DB6D-0ABC-4938-A36E-2F68AB94635C"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00052:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "086B95BE-3C22-4A6F-8D6A-20E550AD87D4"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00057:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0049AFD-B450-45A3-9067-423558EF8AD8"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00061:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "514B78B6-E0EE-40D6-A3FF-3DFAAF422187"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1.00028:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56A5414A-43FC-40BD-BD1F-49E9D73FD7B2"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1.02011:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "660D863C-F744-4C54-9553-DE4934632280"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1.04011:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57AF4613-59C0-42B0-AAE5-F1D9E4C4BEC6"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1.06013:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA3CC72A-070B-4924-A8BB-54FCB547C694"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1.06020:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25990F44-B6A3-497B-A57D-E6D2E1993D5D"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1.08005:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31F1CB4A-3A77-480E-A66E-467EF22D5E22"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.00096:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1D44C0A-76C1-4E8C-94D7-7C3679D3BFB1"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.01022:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC2F9555-D1B7-4F1F-B969-ACDB6914B237"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.01035:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CD1B8E4-595B-4DA5-A900-4F2D5412A23A"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.02075:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "402E9717-A5FC-4CD1-A0D2-DD4A5D2D73E4"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.03013:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4EFA6472-55B7-4864-82ED-D93A32AC3530"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.04018:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA911245-AAF8-4931-918F-B920976F7E4F"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.04039:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDD9910A-4609-41B3-97E2-FF1366559C1E"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.05015:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F7700A5-8BFA-445C-B28D-86BDC0293F36"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.06014:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "841DC63B-B6B4-4C78-8A40-58F6DE82F20C"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.00748:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D5C7873-878D-48C4-9461-9B112701DAF0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.01095:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55AE035D-DA9A-4894-A838-DA9266E3859F"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.02039:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55034CB7-FD67-4DB8-A5D6-809ED8922272"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.03086:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "348318D0-1487-4ACE-8F33-63C6F21C62F6"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.04027:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9D07037-565D-4AAB-A447-3B71C6F37C5E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}