CVE-2023-20215

CVSS 3.1 Score 5.3 of 10 (medium)

Details

Published Aug 3, 2023
Updated: Jan 25, 2024
CWE ID 202

Summary

CVE-2023-20215 is a vulnerability affecting the scanning engines of Cisco AsyncOS Software used in Cisco Secure Web Appliance. An unauthenticated, remote attacker can exploit this issue by sending crafted HTTP responses to an affected device. The vulnerability stems from the engines' inability to properly identify malicious traffic when it is encoded in a specific format. As a result, an attacker may bypass configured rules, enabling unauthorized traffic onto a network that should have been blocked. Successful exploitation could lead to serious security risks.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Cisco AsyncOS

Affected Vendors

  • Cisco Systems Inc