Improper Certificate Validation in Cisco Adaptive Security Appliance (ASA) and Cisco Firewall Threat Defense (FTD) - CVE-2023-20247

Vulnerability identifier: #VU82686

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20247

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper error handling during remote access VPN authentication. A remote user can send a specially crafted request and bypass the configured multiple certificate authentication policy while retaining the privileges and permissions associated with the original connection profile.

Cisco Adaptive Security Appliance (ASA)
Cisco Firewall Threat Defense (FTD)

Install updates from vendor's website.

Cisco Adaptive Security Appliance (ASA) - addressed in versions 9.12.4.62, 9.16.4.27, 9.16.4.38, 9.16.4.39, 9.16.4.42, 9.17.1.33, 9.18.3.53, 9.18.3.55, 9.18.3.56, 9.18.4, 9.18.4.5, 9.19.1.18, 9.19.1.22, 9.20.1, 9.20.1.5
Cisco Firewall Threat Defense (FTD) - addressed in versions 9.12.4.62, 9.16.4.27, 9.16.4.38, 9.16.4.39, 9.16.4.42, 9.17.1.33, 9.18.3.53, 9.18.3.55, 9.18.3.56, 9.18.4, 9.18.4.5, 9.19.1.18, 9.19.1.22, 9.20.1, 9.20.1.5

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-multi-cert-dzA3h5PT

• Improper Certificate Validation in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software