CVE-2023-20070

CVSS 3.1 Score 4.0 of 10 (medium)

Details

Published Nov 1, 2023
Updated: Jan 25, 2024
CWE ID 244

Summary

CVE-2023-20070 is a vulnerability affecting the TLS 1.3 implementation in Cisco Firepower Threat Defense (FTD) Software. This issue involves a logic error in memory allocation handling during TLS 1.3 sessions. An unauthenticated, remote attacker can exploit this weakness by sending a carefully crafted message sequence to an affected device. Consequently, the Snort 3 detection engine will unexpectedly restart, leading to a denial of service (DoS) condition. As the Snort detection engine reloads, it drops packets intended for the engine, necessitating automatic recovery with no manual intervention required.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Cisco Firepower Threat Defense

Affected Vendors

  • Cisco Systems Inc