CVE-2024-20391

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM. This vulnerability is due to a lack of authentication on a specific function. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges on an affected device.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
CiscoCisco Secure Client4.9.00086; 4.9.01095; 4.9.02028; 4.9.03047; 4.9.03049; 4.9.04043; 4.9.04053; 4.9.05042; 4.9.06037; 4.10.00093; 4.10.01075; 4.10.02086; 4.10.03104; 4.10.04065; 4.10.04071; 4.10.05085; 4.10.05095; 4.10.05111; 4.10.06079; 4.10.06090
ciscosecure_client4.9.01095
ciscosecure_client4.9.02028
ciscosecure_client4.9.03047
ciscosecure_client4.9.03049
ciscosecure_client4.9.04043
ciscosecure_client4.9.04053
ciscosecure_client4.9.05042
ciscosecure_client4.9.06037
ciscosecure_client4.10.00093
ciscosecure_client4.10.01075
ciscosecure_client4.10.02086
ciscosecure_client4.10.03104
ciscosecure_client4.10.04065
ciscosecure_client4.10.04071
ciscosecure_client4.10.05085
ciscosecure_client4.10.05095
ciscosecure_client4.10.05111
ciscosecure_client4.10.06079
ciscosecure_client4.10.06090
ciscosecure_client4.10.07061
ciscosecure_client4.10.07062
ciscosecure_client4.10.07073
ciscosecure_client4.10.08025
ciscosecure_client4.10.08029
ciscosecure_client5.0.00238
ciscosecure_client5.0.00529
ciscosecure_client5.0.00556
ciscosecure_client5.0.01242
ciscosecure_client5.0.02075
ciscosecure_client5.0.03072
ciscosecure_client5.0.03076
ciscosecure_client5.0.04032
ciscosecure_client5.0.05040
ciscosecure_client4.9.00086
ciscosecure_client5.1.0.136
ciscosecure_client5.1.1.42
ciscosecure_client5.1.2.42

References

Timeline

Published
May 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-203926.1A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remCVE-2024-203938.8A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers CVE-2024-203945.5A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (DCVE-2024-203957.3A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to CVE-2024-203966.5A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive infoCVE-2024-203975.2A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected deviceCVE-2024-203987.8A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on CVE-2024-203996.7A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute aCVE-2024-20404.3The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private grouCVE-2024-204004.7A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirectCVE-2024-204019.8A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote CVE-2024-204028.6A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Softwar
CVE-2024-20391: Medium severity, CVSS 6.8 | Vulnix