发布于3月6日3月6日 Members Cisco FTD: CVE-2023-20247: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Access SSL VPN Multiple Certificate Authentication Bypass Vulnerability Severity 4 CVSS (AV:N/AC:L/Au:S/C:N/I:P/A:N) Published 11/01/2023 Created 02/07/2025 Added 01/29/2025 Modified 02/12/2025 Description A vulnerability in the remote access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to bypass a configured multiple certificate authentication policy and connect using only a valid username and password. This vulnerability is due to improper error handling during remote access VPN authentication. An attacker could exploit this vulnerability by sending crafted requests during remote access VPN session establishment. A successful exploit could allow the attacker to bypass the configured multiple certificate authentication policy while retaining the privileges and permissions associated with the original connection profile. Solution(s) cisco-ftd-upgrade-latest References https://attackerkb.com/topics/cve-2023-20247 CVE - 2023-20247 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-multi-cert-dzA3h5PT cisco-sa-asaftd-multi-cert-dzA3h5PT
参与讨论
你可立刻发布并稍后注册。 如果你有帐户，立刻登录发布帖子。
注意：你的帖子需要版主批准后才能看到。