Secure Client (AnyConnect)
CVE-2025-20206: Cisco Secure Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability
A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Cisco Secure Client 4.9 | See the advisory |
| Cisco Secure Client 4.9 | See the advisory |
| Cisco Secure Client 4.9 | See the advisory |
| Cisco Secure Client 4.9 | See the advisory |
| Cisco Secure Client 4.9 | See the advisory |
| Cisco Secure Client 4.9 | See the advisory |
| Cisco Secure Client 4.9 | See the advisory |
| Cisco Secure Client 4.9 | See the advisory |
| Cisco Secure Client 4.9 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 5.0 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 5.0 | See the advisory |
| Cisco Secure Client 5.0 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 5.0 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 5.0 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 5.0 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 5.0 | See the advisory |
| Cisco Secure Client 5.0 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 5.0 | See the advisory |
| Cisco Secure Client 5.1 | See the advisory |
| Cisco Secure Client 5.1 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 5.1 | See the advisory |
| Cisco Secure Client 4.10 | See the advisory |
| Cisco Secure Client 5.1 | See the advisory |
| Cisco Secure Client 5.1 | See the advisory |
| Cisco Secure Client 5.1 | See the advisory |
| Cisco Secure Client 5.1 | See the advisory |
| Cisco Secure Client 5.1 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client.
This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid user credentials on the Windows system.
Exploitation
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 11 Oct 2026.