CVE-2015-6306

Cisco AnyConnect Secure Mobility Client 4.1(8) - Privilege Escalation via Crafted Installation File

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-6306. PoCs published by Yorick Koster.

AI-analyzed exploit summary This exploit leverages a privilege escalation vulnerability in Cisco AnyConnect by crafting a malicious DMG file and using a local socket to execute arbitrary commands with elevated privileges. The PoC writes a DMG to disk, communicates with a local service on port 29754, and executes a command to gain root access.

Description

Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a crafted installation file, aka Bug ID CSCuv11947.

Exploits (1)

exploitdb WORKING POC
by Yorick Koster · clocalosx
https://www.exploit-db.com/exploits/38303

This exploit leverages a privilege escalation vulnerability in Cisco AnyConnect by crafting a malicious DMG file and using a local socket to execute arbitrary commands with elevated privileges. The PoC writes a DMG to disk, communicates with a local service on port 29754, and executes a command to gain root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Cisco AnyConnect Secure Mobility Client (versions prior to 4.1.07035)
No auth needed
Prerequisites: Local access to a vulnerable Cisco AnyConnect installation · Ability to write files to /private/tmp
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1033656
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/536534/100/0/threaded
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/38303/
Third Party Advisory, VDB Entry mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2015/Sep/86
Vendor Advisory vendor-advisory x_refsource_cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=41135

Scores

EPSS 0.0355
EPSS Percentile 88.0%

Details

CWE
CWE-264
Status published
Products (1)
cisco/anyconnect_secure_mobility_client 4.1.\(8\)
Published Sep 26, 2015
Tracked Since Feb 18, 2026