CVE-2023-20107: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability
First published: Thu Mar 23 2023(Updated: )
A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. This vulnerability is due to insufficient entropy in the DRBG for the affected hardware platforms when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Adaptive Security Appliance | <9.12.1 | |
| Cisco Firepower Threat Defense | <6.4.0 | |
| Cisco ASA 5506-X | ||
| Cisco Asa 5506h-x | ||
| Cisco Asa 5506w-x | ||
| Cisco Asa 5508-x | ||
| Cisco Asa 5516-x |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-20107.
What is the severity level of CVE-2023-20107?
The severity level of CVE-2023-20107 is high with a CVSS score of 7.5.
Which software is affected by CVE-2023-20107?
The Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software versions up to 9.12.1 and 6.4.0 respectively are affected.
What is the risk associated with CVE-2023-20107?
The vulnerability in the deterministic random bit generator (DRBG) could allow an unauthorized attacker to predict or brute-force the random numbers used for encryption, compromising the security of the affected systems.
Is there a fix available for CVE-2023-20107?
Yes, Cisco has released software updates to address the vulnerability. It is recommended to update to the latest available versions.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/last-modified-date
- agent/title
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco adaptive security appliance
- canonical/cisco firepower threat defense
- canonical/cisco asa 5506-x
- canonical/cisco asa 5506h-x
- canonical/cisco asa 5506w-x
- canonical/cisco asa 5508-x
- canonical/cisco asa 5516-x