CVE-2023-20071: cisco cisco cyber vision

Vulnerability summary

CVE-2023-20071 is a medium (CVSS 5.8) vulnerability in cisco cisco cyber vision. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.2% of scored vulnerabilities.

Timeline

1. 01-11-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a flaw in the FTP module of the Snort detection engine. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and deliver a malicious payload.

• CWE-1039Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition MechanismThe product uses an automated mechanism such as machine learning to recognize complex data inputs (e.g. image or audio) as a particular concept or category, but it does not properly detect or handle inputs that have been modified or constructed in a way that causes the mechanism to detect a different, incorrect concept.