CVE-2023-20071
Cisco Secure Firewall Threat Defense ≤ 6.4.0.17
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-20071 is a medium-severity Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism (CWE-1039) vulnerability in Cisco Secure Firewall Threat Defense. Its CVSS base score is 5.8 (Medium).
Operationally, ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-24250
Vulnerability Data
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a flaw in the FTP module…
more
of the Snort detection engine. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and deliver a malicious payload.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle requires adversarial testing and robustness validation for ML-based recognition components.
A.8.26 only requires that security requirements (including resilience against attacks such as injections) be identified and specified during development or acquisition; it does not itself enforce, implement, or prevent exploitation of adversarial input perturbations in ML recognition mechanisms.
Secure architecture principles include resilience against input manipulation and adversarial ML attacks.
Secure coding practices can incorporate input sanitization and adversarial robustness checks for ML models.
Security testing in development can explicitly cover adversarial input testing for recognition mechanisms.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-1039, a class-level weakness, and none of its children carries one either.