CVE-2025-20206
Last modified
CVE-2025-20206 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client. This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client. This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid user credentials on the Windows system.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Secure Client | < 5.1.8.105 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-20206?
How severe is CVE-2025-20206?
How do I fix CVE-2025-20206?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-20200A vulnerability in the CLI of Cisco IOS XE Software could al…8.2
- CVE-2025-20201A vulnerability in the CLI of Cisco IOS XE Software could al…6.7
- CVE-2025-20202A vulnerability in Cisco IOS XE Wireless Controller Software…7.4
- CVE-2025-20203A vulnerability in the web-based management interface of Cis…4.8
- CVE-2025-20204Multiple vulnerabilities in the web-based management interfa…4.8
- CVE-2025-20205Multiple vulnerabilities in the web-based management interfa…4.8
- CVE-2025-20207A vulnerability in Simple Network Management Protocol (SNMP)…4.3
- CVE-2025-20208A vulnerability in the web-based management interface of Cis…5.4
- CVE-2025-20209A vulnerability in the Internet Key Exchange version 2 (IKEv…7.5
- CVE-2025-2021Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote…7.8
- CVE-2025-20210A vulnerability in the management API of Cisco Catalyst Cent…7.3
- CVE-2025-20211A vulnerability in the web-based management interface of Cis…6.1
Are you affected by CVE-2025-20206?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST