CVE-2015-6305 - CVE House
Back to Database
Status published High CVE-2015-6305

Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe...

Vulnerability Description

Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility Client 2.0 through 4.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by dbghelp.dll, aka Bug ID CSCuv01279. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4211.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-6305

Credits & Attribution

No credits recorded in the NVD database.

References

More from cisco

View All →
CVE-2025-27091
OpenH264 Decoding Functions Heap Overflow Vulnerability
High 8.6
CVE-2023-25653
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
High 7.5
CVE-2021-33478
The TrustZone implementation in certain Broadcom MediaxChange firmware could allow...
Medium 6.8
CVE-2020-16139
A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0...
High 7.5
CVE-2020-16138
A denial-of-service issue in Cisco Unified IP Conference Station 7937G...
High 7.5

Affected Vendor

Affected Software

anyconnect secure mobility client
Vulnerable Versions:
2.0.0343, 2.1.0.148, 2.2.0133, 2.2.0136, 2.2.0140, 2.3.0185, 2.3.0254, 2.3.1003, 2.3.2016, 2.4.0202, 2.4.1012, 2.5.0217, 2.5.2006, 2.5.2010, 2.5.2011, 2.5.2014, 2.5.2017, 2.5.2018, 2.5.2019, 2.5.3041, 2.5.3046, 2.5.3051, 2.5.3054, 2.5.3055, 2.5_base, 3.0.0, 3.0.0629, 3.0.1047, 3.0.2052, 3.0.3050, 3.0.3054, 3.0.4235, 3.0.5075, 3.0.5080, 3.0.09231, 3.0.09266, 3.0.09353, 3.1\(60\), 3.1.0, 3.1.02043, 3.1.05182, 3.1.05187, 3.1.06073, 3.1.07021, 4.0\(48\), 4.0\(64\), 4.0\(2049\), 4.0.0, 4.0.00048, 4.0.00051, 4.1.0

Timeline

Official Publish: September 25th, 2015
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.