#VU82708 Security features bypass in Cisco Systems, Inc products - CVE-2023-20071

Vulnerability identifier: #VU82708

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2023-20071

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Cisco Firewall Threat Defense (FTD)
FirePOWER Services
Cyber Vision
Umbrella Secure Internet Gateway
Open Source Snort 2
Open Source Snort 3
Cisco UTD Snort IPS Engine Software for IOS XE
Cisco UTD Engine for IOS XE SD-WAN
Meraki MX Security Appliances
Cisco 1000 Series Integrated Services Routers
4000 Series Integrated Services Routers
Catalyst 8000V Edge Software
Catalyst 8200 Series Edge Platforms
Catalyst 8300 Series Edge Platforms
Catalyst 8500L Series Edge Platforms
Cloud Services Routers 1000V Series
Integrated Services Virtual Router
Cisco Meraki MX64
Cisco Meraki MX64W
Cisco Meraki MX65
Cisco Meraki MX65W
Cisco Meraki MX67
Cisco Meraki MX67C
Cisco Meraki MX68
Cisco Meraki MX68WC
Cisco Meraki MX75
Cisco Meraki MX84
Cisco Meraki MX85
Cisco Meraki MX95
Cisco Meraki MX100
Cisco Meraki MX105
Cisco Meraki MX250
Cisco Meraki MX400
Cisco Meraki MX450
Cisco Meraki MX600
Cisco Meraki MX67W
Cisco Meraki MX68W

Software vendor:
Cisco Systems, Inc

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a flaw in the FTP module of the Snort detection engine. A remote attacker can send specially crafted FTP traffic, bypass FTP inspection and deliver a malicious payload.

Install updates from vendor's website.

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-ftd-zXYtnjOM