CVE-2023-20006

A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to an implementation error within the cryptographic functions for SSL/TLS traffic processing when they are offloaded to the hardware. An attacker could exploit this vulnerability by sending a crafted stream of SSL/TLS traffic to an affected device. A successful exploit could allow the attacker to cause an unexpected error in the hardware-based cryptography engine, which could cause the device to reload.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ssl-dos-uu7mV5p6	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:cisco:firepower_threat_defense:7.2.1:::::::*
	cpe:2.3:a:cisco:firepower_threat_defense:7.2.2:::::::*
	cpe:2.3:a:cisco:firepower_threat_defense:7.2.3:::::::*
	cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4:::::::*
	cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2:::::::*
	cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.5:::::::*

OR	cpe:2.3:h:cisco:firepower_2110:-:::::::*
	cpe:2.3:h:cisco:firepower_2120:-:::::::*
	cpe:2.3:h:cisco:firepower_2130:-:::::::*
	cpe:2.3:h:cisco:firepower_2140:-:::::::*

History

16 Aug 2023, 16:17

Type	Values Removed	Values Added
First Time		Cisco adaptive Security Appliance Software
CPE	cpe:2.3:a:cisco:adaptive_security_appliance:9.16.4:::::::* cpe:2.3:a:cisco:adaptive_security_appliance:9.18.2.5:::::::* cpe:2.3:a:cisco:adaptive_security_appliance:9.18.2:::::::*	cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.5:::::::* cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4:::::::* cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2:::::::*

12 Jul 2023, 16:15

Type	Values Removed	Values Added
Summary	A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to an implementation error within the cryptographic functions for SSL/TLS traffic processing when they are offloaded to the hardware. An attacker could exploit this vulnerability by sending a crafted stream of SSL/TLS traffic to an affected device. A successful exploit could allow the attacker to cause an unexpected error in the hardware-based cryptography engine, which could cause the device to reload.	A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to an implementation error within the cryptographic functions for SSL/TLS traffic processing when they are offloaded to the hardware. An attacker could exploit this vulnerability by sending a crafted stream of SSL/TLS traffic to an affected device. A successful exploit could allow the attacker to cause an unexpected error in the hardware-based cryptography engine, which could cause the device to reload.

07 Jul 2023, 19:46

Type	Values Removed	Values Added
First Time		Cisco firepower Threat Defense Cisco firepower 2130 Cisco firepower 2140 Cisco firepower 2110 Cisco Cisco adaptive Security Appliance Cisco firepower 2120
CPE		cpe:2.3:h:cisco:firepower_2130:-:::::::* cpe:2.3:a:cisco:adaptive_security_appliance:9.16.4:::::::* cpe:2.3:a:cisco:firepower_threat_defense:7.2.2:::::::* cpe:2.3:a:cisco:adaptive_security_appliance:9.18.2.5:::::::* cpe:2.3:h:cisco:firepower_2110:-:::::::* cpe:2.3:a:cisco:adaptive_security_appliance:9.18.2:::::::* cpe:2.3:h:cisco:firepower_2140:-:::::::* cpe:2.3:h:cisco:firepower_2120:-:::::::* cpe:2.3:a:cisco:firepower_threat_defense:7.2.3:::::::* cpe:2.3:a:cisco:firepower_threat_defense:7.2.1:::::::*
CWE		CWE-681
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~(CISCO) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ssl-dos-uu7mV5p6 -~~	(CISCO) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ssl-dos-uu7mV5p6 - Vendor Advisory

28 Jun 2023, 15:25

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-06-28 15:15

Updated : 2024-01-25 17:15

NVD link : CVE-2023-20006

Mitre link : CVE-2023-20006

CVE.ORG link : CVE-2023-20006

JSON object : View

Products Affected

cisco

adaptive_security_appliance_software
firepower_2110
firepower_threat_defense
firepower_2140
firepower_2120
firepower_2130

CWE

CWE-681

Incorrect Conversion between Numeric Types

7.5 /10