Security Resilience

CVE-2023-20006

Cisco Secure Firewall Threat Defense 7.2.1 … 7.2.3

Published
28 June 2023
Modified
11 August 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0093 60th percentile
Risk Priority 63 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-20006 is a high-severity Incorrect Conversion between Numeric Types (CWE-681) vulnerability in Cisco Secure Firewall Threat Defense. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 40% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an affected device to…

more

reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to an implementation error within the cryptographic functions for SSL/TLS traffic processing when they are offloaded to the hardware. An attacker could exploit this vulnerability by sending a crafted stream of SSL/TLS traffic to an affected device. A successful exploit could allow the attacker to cause an unexpected error in the hardware-based cryptography engine, which could cause the device to reload.

CWE(s)
CWE-681

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1001.002 Steganography Command And Control
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1006 Direct Volume Access Stealth
Adversaries may directly access a volume to bypass file access controls and file system monitoring.
attack.mitre.org →
T1008 Fallback Channels Command And Control
Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-20330Same product: Cisco Firepower 2110
CVE-2023-20244Same product: Cisco Firepower 2110
CVE-2024-20402Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20022Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20049Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20100Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20408Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20494Same product: Cisco Adaptive Security Appliance Software
CVE-2025-20333Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20025Same product: Cisco Adaptive Security Appliance Software

Affected Assets

cisco
secure firewall threat defense
7.2.1, 7.2.2, 7.2.3
cisco
adaptive security appliance software
9.16.4, 9.18.2, 9.18.2.5

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require code reviews, static analysis, and developer training that catch and prevent numeric type-conversion errors.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
blocks

Secure development lifecycle includes type-safety and conversion checks that reduce numeric truncation risks.

A.8.26 Application security requirements partial match
blocks

A.8.26 requires identifying and specifying security requirements (including resilience against certain attacks like buffer overflows or SQL injection) but does not itself implement any conversion checks, bounds validation, or other mechanisms that would stop exploitation of incorrect numeric type conversions

A.8.27 Secure system architecture and engineering principles partial match
blocks

Secure architecture principles promote strong typing and safe conversion practices.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly address correct numeric type conversions and overflow checks.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect numeric conversion defects before release.

A.8.8 Management of technical vulnerabilities partial match
removes

References