CVE-2023-20245
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Multiple vulnerabilities in the per-user-override feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass a configured ACL and allow traffic that should be denied. These vulnerabilities are due to a logic error in constructing and applying per-user-override rules. A successful exploit could allow the attacker to bypass the interface ACL and access protected resources.
Risk Assessment
The organization may face unauthorized access to protected network resources, potentially leading to data confidentiality and integrity breaches.
Recommendation
Apply updates provided by Cisco for ASA and FTD software. Review per-user-override configurations and consider temporarily disabling this feature if not essential.
Other vulnerabilities in Cisco ASA Software
See all- CVE-2016-6432High
A vulnerability in the Identity Firewall feature of Cisco ASA Software before version 9.6(2.1) could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The issue is due to a buffer overflow in the affected code area.
- CVE-2016-6431High
A vulnerability in the local Certificate Authority (CA) feature of Cisco ASA Software before version 9.6(1.5) could allow an unauthenticated, remote attacker to cause a reload of the affected system. The issue is due to improper handling of crafted packets during the enrollment operation.
- CVE-2014-3392High
The Clientless SSL VPN portal in Cisco ASA Software before version 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.8), and 9.3(1.1) allows remote attackers to obtain sensitive information from process memory or modify memory contents via crafted parameters.
- CVE-2014-3389High
The VPN implementation in Cisco ASA Software versions before 7.2(5.15), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.6(1.15), 9.0(4.24), 9.1(5.12), 9.2(2.6), and 9.3(1.1) does not properly implement a tunnel filter, allowing remote authenticated users to gain failover-unit access via crafted packets.
- CVE-2014-3388High
The DNS inspection engine in Cisco ASA Software 9.0 before 9.0(4.13), 9.1 before 9.1(5.7), and 9.2 before 9.2(2) allows remote attackers to cause a denial of service (device reload) via crafted DNS packets.
- CVE-2014-3387High
The SunRPC inspection engine in Cisco ASA Software before versions 7.2(5.14), 8.2(5.51), 8.3(2.42), 8.4(7.23), 8.5(1.21), 8.6(1.14), 8.7(1.13), 9.0(4.5), and 9.1(5.3) allows remote attackers to cause a denial of service (device reload) via crafted SunRPC packets.
- CVE-2014-3386High
The GPRS Tunneling Protocol (GTP) inspection engine in Cisco ASA Software before version 8.2(5.51), 8.4(7.15), 8.7(1.13), 9.0(4.8), and 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted series of GTP packets.
- CVE-2014-3385High
A race condition in the Health and Performance Monitoring (HPM) for ASDM feature in Cisco ASA allows remote attackers to cause a denial of service by generating many half-open TCP connections simultaneously.
- CVE-2014-3384High
The IKEv2 implementation in Cisco ASA Software before versions 8.4(7.15), 8.6(1.14), 9.0(4.8), and 9.1(5.1) allows remote attackers to cause a denial of service by sending a crafted packet during tunnel creation.
- CVE-2014-3383High
The IKE implementation in the VPN component in Cisco ASA Software 9.1 before 9.1(5.1) allows remote attackers to cause a denial of service (device reload) via crafted UDP packets.
Original NVD description (English source)
Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should be denied to flow through an affected device. These vulnerabilities are due to a logic error that could occur when the affected software constructs and applies per-user-override rules. An attacker could exploit these vulnerabilities by connecting to a network through an affected device that has a vulnerable configuration. A successful exploit could allow the attacker to bypass the interface ACL and access resources that would should be protected.