CVE-2023-20275 Other in Cisco Adaptive Security Appliance (ASA) Software

Medium 4.1 Published 12 Dec 2023 Updated 2 Aug 2024

Authenticated attackers can spoof another VPN user's source IP address in Cisco ASA and FTD AnyConnect SSL VPN tunnels.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-20275?

CVE-2023-20275 is a medium-severity vulnerability in Cisco Adaptive Security Appliance Software, published on 12 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to send packets with another VPN user's source IP address. This vulnerability is due to improper validation of the packet's inner source IP address after decryption. An attacker could exploit this vulnerability by sending crafted packets through the tunnel. A successful exploit could allow the attacker to send a packet impersonating another VPN user's IP address. It is not possible for the attacker to receive return packets.

Weakness: CWE-346

Which versions are affected by CVE-2023-20275?

It affects 2 products.

Products include Cisco Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense.

How do I fix CVE-2023-20275?

No fix has been published for CVE-2023-20275 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-20275 being exploited?

There is no known exploitation of CVE-2023-20275 in the wild and no public exploit code.

All Cisco Adaptive Security Appliance Software vulnerabilities

Sources

Also known as GHSA-6q64-g7xj-vc8f.