CVE-2023-20107
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability in the deterministic random bit generator (DRBG) in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software for ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling discovery of the device's private key. This is due to insufficient entropy in the DRBG on these hardware platforms. An attacker could exploit this by generating many keys and looking for collisions with target devices.
Risk Assessment
The risk is that an attacker can impersonate a device or decrypt traffic, potentially compromising confidentiality and integrity of communications.
Recommendation
It is recommended to update ASA/FTD software to a patched version and regenerate cryptographic keys on affected devices.
Other vulnerabilities in Cisco Adaptive Security Appliance
See all- CVE-2024-20485Medium
A vulnerability in the VPN web server of Cisco ASA and FTD Software allows an authenticated local attacker with administrator privileges to execute arbitrary code with root privileges. This is due to improper validation of a specific file when read from system flash memory.
- CVE-2023-20006High
A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software for Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an unexpected reload, resulting in a denial of service (DoS). This is due to an implementation error in cryptographic functions when offloaded to hardware. An attacker could exploit this by sending a crafted stream of SSL/TLS traffic.
- CVE-2022-20947High
A vulnerability in dynamic access policies (DAP) functionality of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a device reload, resulting in a denial of service (DoS). This is due to improper processing of HostScan data from the Posture module. An attacker could exploit this by sending crafted HostScan data.
- CVE-2022-20924High
A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS). This is due to insufficient input validation. An attacker could exploit this by sending a crafted SNMP request, causing a device reload.
- CVE-2022-20715High
A vulnerability in the remote access SSL VPN features of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This is due to improper validation of logged errors from client connections. An attacker could exploit this by sending crafted requests, causing the device to restart.
- CVE-2021-1422High
A vulnerability in the software cryptography module of Cisco ASA and FTD Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the device, resulting in a denial of service (DoS) condition. This is due to a logic error in handling specific decryption errors. An attacker could exploit this by sending malicious packets over an established IPsec connection, causing a crash and reload. Important: Successful exploitation would not compromise encrypted data. This affects only ASA 9.16.1 and FTD 7.0.0.
- CVE-2021-1493High
A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. This is due to insufficient boundary checks for specific data. An attacker could exploit this by sending a malicious HTTP request, potentially disclosing data fragments or causing a device reload and DoS.
- CVE-2020-3436High
A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to upload arbitrary-sized files to specific folders, leading to an unexpected device reload. The issue is due to inefficient handling of large file writes. An attacker could upload files to trigger a watchdog timeout, causing device reload and DoS.
- CVE-2020-3306High
A vulnerability in the DHCP module of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. This is due to incorrect processing of certain DHCP packets. An attacker could exploit this by sending a crafted DHCP packet, causing a DoS.
- CVE-2020-3305High
A vulnerability in the implementation of the Border Gateway Protocol (BGP) module in Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This is due to incorrect processing of certain BGP packets. An attacker could exploit this by sending a crafted BGP packet, causing a DoS.
Original NVD description (English source)
A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. This vulnerability is due to insufficient entropy in the DRBG for the affected hardware platforms when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.