CVE-2023-20246
Summary
| CVE | CVE-2023-20246 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-11-01 18:15:00 UTC |
| Updated | 2024-02-05 19:06:00 UTC |
| Description | Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a logic error that occurs when the access control policies are being populated. An attacker could exploit this vulnerability by establishing a connection to an affected device. A successful exploit could allow the attacker to bypass configured access control rules on the affected system. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Firepower Threat Defense | All | All | All | All |
| Operating System | Cisco | Ios Xe | All | All | All | All |
| Application | Cisco | Unified Threat Defense | All | All | All | All |
| Application | Snort | Snort | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Multiple Cisco Products Snort 3 Access Control Policy Bypass Vulnerability | MISC | sec.cloudapps.cisco.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 317399 Cisco Firepower Threat Defense (FTD) Software Snort 3 Snort 3 Access Control Policy Bypass Vulnerability (cisco-sa-ftd-snort3acp-bypass-3bdR2BEh)
- 317414 Cisco Internetwork Operating System (IOS) XE Software Unified Threat Defense Access Control Policy Bypass Vulnerability ( cisco-sa-ftd-snort3acp-bypass-3bdR2BEh)