Cyber Resilience

CVE-2023-20084

Cisco Secure Endpoint 6.0.7 … 8.1.7.21512

Published
22 November 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 5.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
EPSS Score 0.0017 7th percentile
Risk Priority 38 floored blend · peak EPSS

Summary

CVE-2023-20084 is a medium-severity Incomplete Model of Endpoint Features (CWE-437) vulnerability in Cisco Secure Endpoint. Its CVSS base score is 5.0 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Rootkit (T1014); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software…

more

components. An attacker could exploit this vulnerability by persuading a user to put a malicious file into a specific folder and then persuading the user to execute the file within a limited time window. A successful exploit could allow the attacker to cause the endpoint software to fail to quarantine the malicious file or kill its process. Note: This vulnerability only applies to deployments that have the Windows Folder Redirection feature enabled.

CWE(s)
CWE-437NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1014 Rootkit Stealth
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
attack.mitre.org →
T1497 Virtualization/Sandbox Evasion Stealth
Adversaries may employ various means to detect and avoid virtualization and analysis environments.
attack.mitre.org →
T1497.001 System Checks Stealth
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
attack.mitre.org →
T1622 Debugger Evasion Stealth
Adversaries may employ various means to detect and avoid debuggers.
attack.mitre.org →
T1564 Hide Artifacts Stealth
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-20212Same product: Cisco Secure Endpoint
CVE-2024-20290Same product: Cisco Secure Endpoint
CVE-2025-20234Same product: Cisco Secure Endpoint
CVE-2023-20197Same product: Cisco Secure Endpoint
CVE-2025-20128Same product: Cisco Secure Endpoint
CVE-2024-57176Shared CWE-437
CVE-2024-20285Same vendor: Cisco
CVE-2025-20137Same vendor: Cisco
CVE-2024-20319Same vendor: Cisco
CVE-2023-20267Same vendor: Cisco

Affected Assets

cisco
secure endpoint
6.0.7, 6.0.9, 6.1.5, 6.1.7, 6.1.9
cisco
secure endpoint private cloud
≤ 4.1.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.CM-01 mostly match
degrades

CWE-437's incomplete endpoint model directly impairs a monitor's detection logic (mostly degrading DE.CM-01's adverse-event finding), while the same flaw removes most of the monitoring outcome's reliability across its scope.

RS.MI-01 partial match
degrades

CWE-437 can cause monitoring/containment products to take incorrect actions due to an incomplete endpoint model, impairing (but not fully defeating) RS.MI-01's automatic or manual containment capability.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can validate that the intermediary correctly handles all documented and undocumented endpoint features.

A.8.20 Networks security partial match
degrades

Network security controls can enforce endpoint capability discovery and validation, reducing the risk of acting on an incomplete model.

A.8.21 Security of network services partial match
degrades

Defining security requirements for network services can include explicit endpoint feature negotiation and state tracking.

A.8.25 Secure development life cycle partial match
prevents

A secure SDLC can mandate complete endpoint capability modeling during design and threat modeling phases.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify the need for exhaustive endpoint feature, behavior, and state modeling.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles emphasize complete system modeling, including all endpoint capabilities and states.

References