Key management errors in Cisco Systems, Inc products - CVE-2023-20107
Published: March 23, 2023
Vulnerability identifier: #VU73975
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-20107
CWE-ID: CWE-320
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a cryptographic collision.
The vulnerability exists due to insufficient entropy in the deterministic random bit generator (DRBG) for the affected hardware platforms when generating cryptographic keys. A remote attacker can generate a large number of cryptographic keys, discover the private key and decrypt traffic that is sent to or from the target device.
Affected software
Cisco Secure Firewall Adaptive Security Appliance (ASA)
Cisco Secure Firewall Threat Defense (FTD)
Adaptive Security Appliance 5506H-X
Adaptive Security Appliance 5506W-X
Adaptive Security Appliance 5508-X
Adaptive Security Appliance 5516-X
Cisco Secure Firewall Threat Defense (FTD)
Adaptive Security Appliance 5506H-X
Adaptive Security Appliance 5506W-X
Adaptive Security Appliance 5508-X
Adaptive Security Appliance 5516-X
How to mitigate CVE-2023-20107
Install updates from vendor's website.
Cisco Secure Firewall Adaptive Security Appliance (ASA) - update to 9.12.1
Cisco Secure Firewall Threat Defense (FTD) - update to 6.4.0
Cisco Secure Firewall Threat Defense (FTD) - update to 6.4.0