Cisco Duo Two-Factor Authentication on Windows/macOS Offline Access Mode authentication replay

Summaryinfo

A vulnerability was found in Cisco Duo Two-Factor Authentication on Windows/macOS. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Offline Access Mode. Performing a manipulation results in authentication replay. This vulnerability is reported as CVE-2023-20123. The attack may be carried out on the physical device. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in Cisco Duo Two-Factor Authentication on Windows/macOS (unknown version). This affects an unknown code block of the component Offline Access Mode. The manipulation with an unknown input leads to a authentication replay vulnerability. CWE is classifying the issue as CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an unauthenticated, physical attacker to replay valid user session credentials and gain unauthorized access to an affected macOS or Windows device. This vulnerability exists because session credentials do not properly expire. An attacker could exploit this vulnerability by replaying previously used multifactor authentication (MFA) codes to bypass MFA protection. A successful exploit could allow the attacker to gain unauthorized access to the affected device.

The weakness was disclosed 04/06/2023 as cisco-sa-duo-replay-knuNKd. It is possible to read the advisory at sec.cloudapps.cisco.com. This vulnerability is uniquely identified as CVE-2023-20123 since 10/27/2022. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1040 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-24302). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Duo Two-Factor Authentication

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion