A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to send packets with another VPN user's source IP address. This vulnerability is due to improper validation of the packet's inner source IP address after decryption. An attacker could exploit this vulnerability by sending crafted packets through the tunnel. A successful exploit could allow the attacker to send a packet impersonating another VPN user's IP address. It is not possible for the attacker to receive return packets.
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required Low
Scope Changed
Confidentiality Impact None
Integrity Impact Low
Availability Impact None
User Interaction Required
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Key SSVC decision points have not yet been added.
Affected Vendors & Products
Vendors | Products |
---|---|
Cisco |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
No data.
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: cisco
Published: 2023-12-12T18:06:17.467Z
Updated: 2024-08-02T09:05:36.246Z
Reserved: 2022-10-27T18:47:50.374Z
Link: CVE-2023-20275
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-12-12T18:15:16.520
Modified: 2024-01-25T17:15:43.557
Link: CVE-2023-20275
Redhat
No data.