VPN client impersonation in Cisco Adaptive Security Appliance and Firepower Threat Defense software

1) Insufficient verification of data authenticity

EUVDB-ID: #VU83885

Risk: Low

CVSSv3.1: 3.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-20275

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote user to impersonate other VPN users.

The vulnerability exists due to improper validation of the packet's inner source IP address after decryption in the AnyConnect SSL VPN feature. A remote user can send specially crafted packets through the tunnel, impersonate another VPN user's IP address and receive return packets.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco Adaptive Security Appliance (ASA): All versions

Cisco Firepower Threat Defense (FTD): All versions

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-vpn-Y88QOm77
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd98316

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.