Business Logic Errors in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) - CVE-2023-20256

Vulnerability identifier: #VU82670

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20256

CWE-ID: CWE-840

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a logic error that can occur when the affected software constructs and applies per-user-override rules. A remote attacker can bypass the interface ACL and access resources that should be protected.

Cisco Secure Firewall Adaptive Security Appliance (ASA)
Cisco Secure Firewall Threat Defense (FTD)

Install updates from vendor's website.

Cisco Secure Firewall Adaptive Security Appliance (ASA) - addressed in versions 9.12.4.58, 9.12.4.62, 9.16.4.18, 9.16.4.19, 9.16.4.27, 9.16.4.38, 9.16.4.39, 9.16.4.42, 9.17.1.33, 9.18.3.39, 9.18.3.46, 9.18.3.53, 9.18.3.55, 9.18.3.56, 9.18.4, 9.18.4.5, 9.19.1.9, 9.19.1.12, 9.19.1.18, 9.19.1.22, 9.20.1, 9.20.1.5
Cisco Secure Firewall Threat Defense (FTD) - addressed in versions 9.12.4.58, 9.12.4.62, 9.16.4.18, 9.16.4.19, 9.16.4.27, 9.16.4.38, 9.16.4.39, 9.16.4.42, 9.17.1.33, 9.18.3.39, 9.18.3.46, 9.18.3.53, 9.18.3.55, 9.18.3.56, 9.18.4, 9.18.4.5, 9.19.1.9, 9.19.1.12, 9.19.1.18, 9.19.1.22, 9.20.1, 9.20.1.5

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ac-acl-bypass-bwd7q6Gb

• Multiple vulnerabilities in Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software