A vulnerability in the interprocess communication channel of the Secure Firewall Posture module in Cisco Secure Client permits an authenticated local attacker to elevate privileges. The flaw results from insufficient validation of user‑supplied input; crafted IPC messages sent to a local socket enable the attacker to write files with SYSTEM or root privileges. Because the module is present on Windows, macOS, and Linux, the impact ranges from limited file writes on Windows to full root privileges on macOS and Linux, a significant privilege escalation.

Systems running Cisco Secure Client with the Secure Firewall Posture module are affected. The product is Cisco Secure Client, vendor Cisco. The vulnerability applies across multiple operating systems: Windows, macOS, and Linux. No specific version numbers are supplied, so all installations of the Secure Firewall Posture module remain potentially vulnerable until patches are applied.

The CVSS base score is 5.5, indicating moderate severity, but the advisory’s Security Impact Rating is High because of the possibility of obtaining full root on macOS and Linux. Exploitation requires a local authenticated user with access to the IPC socket; remote exploitation is not possible. EPSS information is unavailable, and the issue is not listed in the CISA KEV catalog, so no widespread exploit activity has been reported yet. Organizations should treat this as a local privilege escalation risk and evaluate whether their environment uses the affected module.