Cisco Security Advisory: Recent Vulnerabilities and Fixes
Cisco reports an SSO authentication bypass in BroadWorks (CVE-2023-20238), RADIUS processing disruption in ISE (CVE-2023-20243), and a VPN flaw enabling brute force attacks in ASA and FTD (CVE-2023-20269). Apply Cisco fixes for BroadWorks and ISE; use MFA, VPN settings and DAP rules to protect ASA and FTD.
Summary written with AI from this article, and checked against it.
Affected systems and impact
| Flaw | Affected systems | Impact |
|---|---|---|
| CVE-2023-20238Authentication bypass caused by a weakness in the single sign-on (SSO) implementation | Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform | Remote attackers can forge credentials, commit toll fraud and execute commands with the forged account's privileges. |
| CVE-2023-20243Improper handling of certain RADIUS accounting requests | RADIUS message processing in Cisco Identity Services Engine (ISE) | RADIUS processing disruptions cause authentication or authorization timeouts, denying legitimate users network or service access. |
| CVE-2023-20269VPN feature vulnerability allowing brute force attacks | VPN feature of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) | Remote attackers can brute force existing accounts and potentially establish an unauthorized clientless SSL VPN session. |
In the dynamic realm of cybersecurity, staying ahead of potential threats is of paramount importance. Cisco, a global leader in IT and networking, has recently identified several vulnerabilities that are critical to address. This article provides a comprehensive analysis of these security alerts, offering readers an understanding of the risk factors and protective measures to be implemented. Let's delve deep into each vulnerability to understand them in detail.
Vulnerability Risk Scoring: An Overview
In order to gauge the severity of these vulnerabilities, we can refer to the Common Vulnerability Scoring System (CVSS) version 3, which assigns a score out of 10 to each vulnerability based on its risk factor. Here are the scores for the recent vulnerabilities identified by Cisco:
- CVE-2023-20238: 10 (Critical)
- CVE-2023-20243: 8.6 (High Severity)
- CVE-2023-20269: 5 (Medium Severity)
Comprehensive Details of Each Vulnerability
CVE-2023-20238 (Critical)
Description
The most critical vulnerability identified is found within the Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform. It is essentially an authentication bypass flaw that originated from a weakness in the single sign-on (SSO) implementation, uncovered during internal testing.
Impact
The implications of this flaw are profound. If exploited successfully, an unauthenticated, remote attacker can forge credentials to access the affected system without valid login details. This can result in malicious activities including toll fraud and executing commands with the privileges of the forged account. Particularly, if an administrator account is compromised, the attacker would be able to modify settings and access confidential data.
Recommendation
To curb the potential damage, it is recommended to apply the fixes provided by Cisco, which are available in specific versions. Additionally, it is advised to closely monitor user IDs linked to the Cisco BroadWorks systems and establish strong authentication protocols to enhance security.
CVE-2023-20243 (High Severity)
Description
This high-severity vulnerability is present in the RADIUS message processing feature of the Cisco Identity Services Engine (ISE). The flaw arises due to the improper handling of certain RADIUS accounting requests, leaving systems susceptible to disruptions.
Impact
If exploited, this vulnerability could lead to disruptions in RADIUS processing, resulting in authentication or authorization timeouts, thereby denying genuine users access to the network or services and potentially causing operational issues.
Recommendation
To mitigate this, organizations are urged to apply patches provided by Cisco, available in the identified versions of the Cisco Identity Services Engine. Monitoring RADIUS requests and logs for unusual activities is also recommended to prevent further breaches.
CVE-2023-20269 (Medium Severity)
Description
This vulnerability, considered to be of medium severity, affects the VPN feature of the Cisco Adaptive Security Appliance (ASA) and the Cisco Firepower Threat Defense (FTD), making systems vulnerable to brute force attacks from unauthorized remote attackers.
Impact
Attackers can potentially exploit this vulnerability to launch brute force attacks against existing accounts, subsequently establishing an unauthorized clientless SSL VPN session within the victim's network. The degree of impact largely depends on the network configuration of the affected organization.
Recommendation
To safeguard against this vulnerability, organizations should implement multi-factor authentication (MFA) to add an extra layer of security. Moreover, various strategies can be employed, such as adjusting VPN settings and configuring DAP rules to prevent unauthorized access, thereby securing the network more robustly.
By comprehending these vulnerabilities in detail, one can foster a more secure network environment. Cisco continues to work diligently to address these issues, and staying updated with their advisories is essential in safeguarding your organization's network infrastructure.
About the author
Vishal · Software & security engineerVishal writes Trickyworld's tutorials and interview-preparation guides on programming, databases, cyber security and AI. Vishal has been shipping production software long enough to have firm opinions about Python, PHP, Node.js, and JavaScript, and to have been wrong about each of them at least once. The work has run the whole stack: Drupal and Laravel applications, React front ends, MySQL and MongoDB underneath, Redis and Memcached for the things that had to be fast, Apache Solr for the things that had to be findable. That last part turned out to matter more than anyone expected. Tune a Solr index for a season, then watch a language model confidently retrieve the wrong document, and you recognise an old problem wearing new clothes. Most of what is hard about AI systems is not the model. It is retrieval, caching, latency budgets, and deciding what the system does when the answer comes back wrong — which is work he has been doing since well before anyone called it AI engineering. He plays a lot of games, which is less a hobby disclosure than an admission of where a good share of his engineering instinct came from. Real-time systems with a frame budget. State that has to stay coherent while a player does something no designer anticipated. The permanent question of what happens when the frame cannot finish in time. Those habits carry over more directly than they have any right to. He has written several books on programming, all built on the same conviction: most technical writing is unclear because the author never decided what to leave out. More from Vishal → · Editorial policy
