Input validation error in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) - CVE-2023-20086

Vulnerability identifier: #VU82679

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20086

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper processing of ICMPv6 messages. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Cisco Secure Firewall Adaptive Security Appliance (ASA)
Cisco Secure Firewall Threat Defense (FTD)

Install updates from vendor's website.

Cisco Secure Firewall Adaptive Security Appliance (ASA) - addressed in versions 9.12.4.56, 9.12.4.58, 9.12.4.62, 9.14.4.23, 9.16.4.14, 9.16.4.18, 9.16.4.19, 9.16.4.27, 9.16.4.38, 9.16.4.39, 9.16.4.42, 9.17.1.30, 9.17.1.33, 9.18.3, 9.18.3.39, 9.18.3.46, 9.18.3.53, 9.18.3.55, 9.18.3.56, 9.18.4, 9.18.4.5, 9.19.1.5, 9.19.1.9, 9.19.1.12, 9.19.1.18, 9.19.1.22, 9.20.1, 9.20.1.5
Cisco Secure Firewall Threat Defense (FTD) - addressed in versions 9.12.4.56, 9.12.4.58, 9.12.4.62, 9.14.4.23, 9.16.4.14, 9.16.4.18, 9.16.4.19, 9.16.4.27, 9.16.4.38, 9.16.4.39, 9.16.4.42, 9.17.1.30, 9.17.1.33, 9.18.3, 9.18.3.39, 9.18.3.46, 9.18.3.53, 9.18.3.55, 9.18.3.56, 9.18.4, 9.18.4.5, 9.19.1.5, 9.19.1.9, 9.19.1.12, 9.19.1.18, 9.19.1.22, 9.20.1, 9.20.1.5

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-icmpv6-t5TzqwNd

• Denial of service in Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software