#VU82686 Improper Certificate Validation in Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) - CVE-2023-20247
Vulnerability identifier: #VU82686
Vulnerability risk: Medium
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID:
CWE-ID:
CWE-295
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Cisco Adaptive Security Appliance (ASA)
Hardware solutions /
Security hardware applicances
Cisco Firepower Threat Defense (FTD)
Hardware solutions /
Security hardware applicances
Vendor: Cisco Systems, Inc
Description
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to improper error handling during remote access VPN authentication. A remote user can send a specially crafted request and bypass the configured multiple certificate authentication policy while retaining the privileges and permissions associated with the original connection profile.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Cisco Adaptive Security Appliance (ASA): 9.8.1 - 9.8.4.48, 9.9.1 - 9.9.2.235, 9.10.1 - 9.19.1.12
Cisco Firepower Threat Defense (FTD): 9.8.1 - 9.8.1.7, 9.8.2 - 9.8.2.45, 9.8.3 - 9.8.3.29, 9.8.4 - 9.8.4.48, 9.9.1 - 9.9.1.5, 9.9.2 - 9.9.2.235, 9.10.1 - 9.10.1.44, 9.12.1 - 9.12.1.3, 9.12.2 - 9.12.2.9, 9.12.3 - 9.12.3.12, 9.12.4 - 9.12.4.58, 9.13.1 - 9.13.1.21, 9.14.1 - 9.14.1.30, 9.14.2 - 9.14.2.15, 9.14.3 - 9.14.3.18, 9.14.4 - 9.14.4.23, 9.15.1 - 9.15.1.21, 9.16.1 - 9.16.1.28, 9.16.2 - 9.16.2.14, 9.16.3 - 9.16.3.23, 9.16.4 - 9.16.4.19, 9.17.1 - 9.17.1.30, 9.18.1 - 9.18.1.3, 9.18.2 - 9.18.2.8, 9.18.3 - 9.18.3.46, 9.19.1 - 9.19.1.12
External links
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-multi-cert-dzA3h5PT
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
