CVE-2023-20071

MediumCVSS 5.8

Published: 01/11/2023(UTC)Updated: 11/08/2026(UTC)Translated: 12/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

41th percentile - higher than 41% of all known CVEs

Summary

A vulnerability in the Snort detection engine in multiple Cisco products could allow an unauthenticated, remote attacker to bypass configured policies. This is due to a flaw in the FTP module. An attacker could send crafted FTP traffic to bypass FTP inspection and deliver a malicious payload.

Risk Assessment

Bypassing FTP inspection may allow an attacker to introduce malware into the network, potentially leading to system infections and security breaches.

Recommendation

Install Cisco updates for products using the Snort engine. Monitor FTP traffic for suspicious patterns and consider additional security measures.

Other vulnerabilities in Snort detection engine

CVE-2024-20342Medium
A vulnerability in the rate filtering feature of the Snort detection engine in multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured rate limiting filter. This is due to an incorrect connection count comparison. An attacker could send traffic exceeding the rate filter to bypass it, allowing unintended traffic into the protected network.

Original NVD description (English source)

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a flaw in the FTP module of the Snort detection engine. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and deliver a malicious payload.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS