CVE-2023-20071
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker…
- Published
- Updated
- Reserved
- Assigned by
- cisco
Description
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a flaw in the FTP module of the Snort detection engine. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and deliver a malicious payload.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ciscoCNA (assigner) | 3.1 | Medium5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| NVDNVD · Modified | 3.1 | Medium5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.68% · top 47% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.
Weakness
Affected products
Cisco · Cisco Firepower Threat Defense Software
- affected 6.2.3
- affected 6.2.3.1
- affected 6.2.3.2
- affected 6.2.3.3
- affected 6.2.3.4
- affected 6.2.3.5
- affected 6.2.3.6
- affected 6.2.3.7
- affected 6.2.3.8
- affected 6.2.3.10
- affected 6.2.3.11
- affected 6.2.3.9
- affected 6.2.3.12
- affected 6.2.3.13
- affected 6.2.3.14
- affected 6.2.3.15
- affected 6.2.3.16
- affected 6.2.3.17
- affected 6.2.3.18
- affected 6.6.0
- affected 6.6.0.1
- affected 6.6.1
- affected 6.6.3
- affected 6.6.4
- affected 6.6.5
- affected 6.6.5.1
- affected 6.6.5.2
- affected 6.6.7
- affected 6.6.7.1
- affected 6.4.0
- affected 6.4.0.1
- affected 6.4.0.3
- affected 6.4.0.2
- affected 6.4.0.4
- affected 6.4.0.5
- affected 6.4.0.6
- affected 6.4.0.7
- affected 6.4.0.8
- affected 6.4.0.9
- affected 6.4.0.10
- and 31 more
Cisco · Cisco Umbrella Insights Virtual Appliance
- affected N/A
- affected 3.0.4
- affected 3.0.0
- affected 3.0.1
- affected 3.0.2
- affected 3.0.3
- affected 3.0.5
- affected 3.0.6
- affected 3.1.0
- affected 3.1.2
- affected 3.1.1
- affected 3.2.3
- affected 3.2.1
- affected 3.2.4
- affected 3.2.0
- affected 3.2.2
- affected 4.0.0
- affected 4.0.1
- affected 4.0.2
- affected 4.0.3
- affected 4.1.0
- affected 4.1.1
- affected 4.1.2
Cisco · Cisco UTD SNORT IPS Engine Software
- affected 16.12.1a
- affected 16.12.2
- affected 16.12.3
- affected 16.12.4
- affected 16.12.5
- affected 16.12.6
- affected 16.12.7
- affected 16.12.8
- affected 16.6.1
- affected 16.6.5
- affected 16.6.6
- affected 16.6.7a
- affected 16.6.9
- affected 16.6.10
- affected 17.1.1
- affected 17.2.1r
- affected 17.3.1a
- affected 17.3.2
- affected 17.3.3
- affected 17.3.4a
- affected 17.3.6
- affected 17.3.5
- affected 17.3.7
- affected 3.17.0S
- affected 3.17.1S
- affected 17.4.1a
- affected 17.4.2
- affected 17.4.1b
- affected 17.5.1a
- affected 17.6.1a
- affected 17.6.2
- affected 17.6.3a
- affected 17.6.4
- affected 17.6.5
- affected 17.7.1a
- affected 17.7.2
- affected 17.10.1a
- affected 17.9.1a
- affected 17.9.2a
- affected 17.9.3a
- and 16 more
What to do
Exploitation: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
References (1)
- cisco-sa-snort-ftd-zXYtnjOM (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-20071)Record last updated .