CVE-2023-20212 Denial of service in Cisco Secure Endpoint

What is CVE-2023-20212?

CVE-2023-20212 is a high-severity denial of service vulnerability in Cisco Secure Endpoint, published on 18 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.

Weakness: CWE-825

Which versions are affected by CVE-2023-20212?

It affects 2 products.

Products include Cisco Secure Endpoint, Cisco Secure Endpoint Private Cloud.

How do I fix CVE-2023-20212?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-20212 being exploited?

There is no known exploitation of CVE-2023-20212 in the wild and no public exploit code.

Other vulnerabilities in Cisco Secure Endpoint

• CVE-2023-20032 Memory corruption in Cisco Secure Endpoint Critical 9.8
• CVE-2022-20770 ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022 High 8.6
• CVE-2026-20348 ClamAV XAR File Format Processing Memory Corruption Vulnerability High 7.5
• CVE-2026-20213 ClamAV PE File Format Processing Out-of-Bounds Memory Corruption Vulnerability High 7.5
• CVE-2026-20214 ClamAV FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-20212, GHSA-25vx-3h3c-mwv8.