PT-2023-17420 · Cisco · Cisco Asa+1

Tobias Moritz · Published 2023-11-01 · Updated 2024-01-25 · CVE-2023-20247

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A vulnerability in the remote access SSL VPN feature could allow an authenticated, remote attacker to bypass a configured multiple certificate authentication policy and connect using only a valid username and password. This is due to improper error handling during remote access VPN authentication. An attacker could exploit this by sending crafted requests during remote access VPN session establishment, potentially allowing them to bypass the configured multiple certificate authentication policy while retaining the privileges and permissions associated with the original connection profile.

Recommendations For Cisco Adaptive Security Appliance (ASA) Software, update to a version that includes the fix for this issue. For Cisco Firepower Threat Defense (FTD) Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the remote access SSL VPN feature until a patch is available. Restrict access to the VPN connection profile to minimize the risk of exploitation.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2023-20247

Affected Products

Cisco Asa

Cisco Ftd

References · 4

• https://osv.dev/vulnerability/CVE-2023-20247 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-multi-cert-dzA3h5PT · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20247 · Security Note
• https://twitter.com/CVEnew/status/1719768414271463707 · Twitter Post