CVE-2023-20071

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-01 · updated 2026-08-11
Weakness: CWE-1039

Description

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a flaw in the FTP module of the Snort detection engine. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and deliver a malicious payload.

Affected products

Cisco Cyber Vision: before 4.1.3 — fixed in 4.1.3
Cisco Meraki Mx Security Appliance Firmware: all versions
Cisco Firepower Threat Defense Software: before 6.4.0.17; from 6.5.0 before 7.0.6; from 7.1.0 before 7.2.4; from 7.3.0 before 7.3.1.2; from 6.7.0 before 7.0.5; from 7.1.0 before 7.1.0.3 — fixed in 6.4.0.17, 7.0.5, 7.0.6, 7.1.0.3, 7.2.1, 7.2.4
Cisco Unified Threat Defense: from 17.3 before 17.3.8; from 17.6 before 17.6.6; from 17.9 before 17.9.4; from 17.11 before 17.11.1a; from 17.12 before 17.12.1a — fixed in 17.11.1a, 17.12.1a, 17.3.8, 17.6.6, 17.9.4

How to fix

Upgrade to a fixed version: Cisco Cyber Vision 4.1.3; Cisco Firepower Threat Defense Software 6.4.0.17, 7.0.5, 7.0.6, 7.1.0.3; Cisco Unified Threat Defense 17.11.1a, 17.12.1a, 17.3.8, 17.6.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-20071 or the next vulnerability affects your stack