CVE-2024-20337
CVE-2024-20337 is a high-severity vulnerability in Cisco Secure Client with a CVSS 3.x base score of 8.2. Its EPSS exploit-prediction score of 30% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-93.
Key facts
- Severity: High (CVSS 3.x base score 8.2)
- EPSS exploit prediction: 30% (98th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-18052
- Weakness: CWE-93
- Affected product: Cisco Secure Client
- Published:
- Last modified:
Description
A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.
Frequently asked questions
- What is CVE-2024-20337?
- A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.
- How severe is CVE-2024-20337?
- CVE-2024-20337 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.
- Is CVE-2024-20337 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 30% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-20337?
- CVE-2024-20337 affects Cisco Secure Client. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-20337?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2024-20337 have an EU (EUVD) identifier?
- Yes. CVE-2024-20337 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-18052.
- When was CVE-2024-20337 published?
- CVE-2024-20337 was published on 2024-03-06 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:cisco:secure_client:*:*:*:*:*:*:*:*
More vulnerabilities in Cisco Secure Client
- CVE-2023-20178 — High (CVSS 7.8): A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco…
- CVE-2024-3661 — High (CVSS 7.6): DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security…
- CVE-2024-20338 — High (CVSS 7.3): A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated,…
- CVE-2025-20206 — High (CVSS 7.1): A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an…
- CVE-2024-20391 — Medium (CVSS 6.8): A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated…
- CVE-2023-20241 — Medium (CVSS 5.5): Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an…
All CVEs affecting Cisco Secure Client →
Other CWE-93 (CRLF Injection) vulnerabilities
- CVE-2024-51501 — Critical (CVSS 10.0): Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit…
- CVE-2026-45372 — Critical (CVSS 9.9): cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's…
- CVE-2026-11362 — Critical (CVSS 9.8): DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not…
- CVE-2025-40671 — Critical (CVSS 9.3): SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve,…
- CVE-2026-11373 — Critical (CVSS 9.1): Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for…
- CVE-2026-50638 — Critical (CVSS 9.1): Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd…