Cisco ASA/Firepower Threat Defense Software SSL VPN improper authentication

Summaryinfo

A vulnerability identified as critical has been detected in Cisco ASA and Firepower Threat Defense Software. This impacts an unknown function of the component SSL VPN. The manipulation leads to improper authentication. This vulnerability is listed as CVE-2023-20247. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Cisco ASA and Firepower Threat Defense Software (Firewall Software) (affected version not known). This issue affects some unknown functionality of the component SSL VPN. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is integrity. The summary by CVE is:

A vulnerability in the remote access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to bypass a configured multiple certificate authentication policy and connect using only a valid username and password. This vulnerability is due to improper error handling during remote access VPN authentication. An attacker could exploit this vulnerability by sending crafted requests during remote access VPN session establishment. A successful exploit could allow the attacker to bypass the configured multiple certificate authentication policy while retaining the privileges and permissions associated with the original connection profile.

The weakness was presented 11/01/2023 as cisco-sa-asaftd-multi-cert-dzA3h5PT. The advisory is shared at sec.cloudapps.cisco.com. The identification of this vulnerability is CVE-2023-20247 since 10/27/2022. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/29/2023).

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• ASA
• Firepower Threat Defense Software

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion