PT-2023-3373 · Cisco · Cisco Duo Two-Factor Authentication For Macos

Published 2023-06-21 · Updated 2023-07-06 · CVE-2023-20199

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Duo Two-Factor Authentication for macOS (affected versions not specified)

Description A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access an affected macOS device. This issue is due to the incorrect handling of responses from Cisco Duo when the application is configured to fail open. An attacker with primary user credentials could exploit this by attempting to authenticate to an affected device, potentially allowing access to the device without valid permission.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-03530

CVE-2023-20199

Affected Products

Cisco Duo Two-Factor Authentication For Macos

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-20199 · Security Note
• https://bdu.fstec.ru/vul/2023-03530 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20199 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-mac-bypass-OyZpVPnx · Vendor Advisory
• https://t.me/cibsecurity/65618 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023062216 · Note
• https://vuldb.com/?id.232099 · Note