Security Resilience

CVE-2023-20177

Cisco Secure Firewall Threat Defense 7.0.0 … 7.3.1.1

Published
01 November 2023
Modified
11 August 2026
Patch / advisory
View advisory
CVSS Score v3.1 4.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
EPSS Score 0.0053 43th percentile
Risk Priority 35 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-20177 is a medium-severity Heap Inspection (CWE-244) vulnerability in Cisco Secure Firewall Threat Defense. Its CVSS base score is 4.0 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A vulnerability in the SSL file policy implementation of Cisco Firepower Threat Defense (FTD) Software that occurs when the SSL/TLS connection is configured with a URL Category and the Snort 3 detection engine could allow an unauthenticated, remote attacker to…

more

cause the Snort 3 detection engine to unexpectedly restart. This vulnerability exists because a logic error occurs when a Snort 3 detection engine inspects an SSL/TLS connection that has either a URL Category configured on the SSL file policy or a URL Category configured on an access control policy with TLS server identity discovery enabled. Under specific, time-based constraints, an attacker could exploit this vulnerability by sending a crafted SSL/TLS connection through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 detection engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. The Snort 3 detection engine will restart automatically. No manual intervention is required.

CWE(s)
CWE-244NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1011 Exfiltration Over Other Network Medium Exfiltration
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.
attack.mitre.org →
T1014 Rootkit Stealth
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
attack.mitre.org →
T1021.007 Cloud Services Lateral Movement
Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.
attack.mitre.org →
T1025 Data from Removable Media Collection
Adversaries may search connected removable media on computers they have compromised to find files of interest.
attack.mitre.org →
T1027 Obfuscated Files or Information Stealth
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-20031Same product: Cisco Secure Firewall Threat Defense
CVE-2023-20070Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20349Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20039Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20006Same product: Cisco Secure Firewall Threat Defense
CVE-2026-20007Same product: Cisco Secure Firewall Threat Defense
CVE-2024-20407Same product: Cisco Secure Firewall Threat Defense
CVE-2023-20267Same product: Cisco Secure Firewall Threat Defense
CVE-2024-20431Same product: Cisco Secure Firewall Threat Defense
CVE-2024-20261Same product: Cisco Secure Firewall Threat Defense

Affected Assets

cisco
secure firewall threat defense
7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-4 Information in Shared System Resources
addresses: CWE-244

Forces clearing of heap memory contents prior to release, preventing subsequent processes from inspecting prior sensitive data.

SI-12 Information Management and Retention
addresses: CWE-244

Information management requirements drive clearing of sensitive contents from memory prior to release or reuse.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-10 partial match
blocks

Explicit example of removing confidential data from process memory directly prevents heap inspection exposure.

PR.PS-06 partial match
blocks

Secure SDLC practices encompass proper sensitive-memory handling but fixing this single CWE does not achieve the control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.10 Information deletion partial match
blocks

A.8.10 is about deleting or securely erasing information (especially on storage media) when it is no longer required; it has no bearing on the presence or exploitability of a heap-memory clearing flaw inside running code that uses realloc() on sensitive buffers.

A.8.19 Installation of software on operational systems partial match
removes
A.8.25 Secure development life cycle partial match
blocks

Secure SDLC processes can incorporate memory-safety requirements but do not specifically mandate heap clearing.

A.8.26 Application security requirements partial match
removes
A.8.27 Secure system architecture and engineering principles partial match
removes
A.8.28 Secure coding partial match
prevents

Mandates secure coding practices that include proper memory sanitization before release.

References