Security Resilience

CVE-2023-20212

Cisco Secure Endpoint ≤ 8.1.7.21585

Published
18 August 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.034 89th percentile
Risk Priority 63 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-20212 is a high-severity Expired Pointer Dereference (CWE-825) vulnerability in Cisco Secure Endpoint. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked in the top 11% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an…

more

affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.

CWE(s)
CWE-825NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1003.007 Proc Filesystem Credential Access
Adversaries may gather credentials from the proc filesystem or `/proc`.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-20084Same product: Cisco Secure Endpoint
CVE-2026-20348Same product: Cisco Secure Endpoint
CVE-2025-20234Same product: Cisco Secure Endpoint
CVE-2025-20128Same product: Cisco Secure Endpoint
CVE-2024-20290Same product: Cisco Secure Endpoint
CVE-2024-20402Same vendor: Cisco
CVE-2023-20027Same vendor: Cisco
CVE-2023-20157Same vendor: Cisco
CVE-2023-20168Same vendor: Cisco
CVE-2023-20158Same vendor: Cisco

Affected Assets

cisco
secure endpoint
≤ 8.1.7.21585
cisco
secure endpoint private cloud
≤ 3.8.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

ID.AM-08 partial match
blocks

Lifecycle management includes secure development and maintenance phases that reduce memory-safety defects.

ID.RA-01 partial match
blocks

Vulnerability identification processes can discover use-after-free flaws via scanning or analysis.

PR.PS-02 partial match
blocks

Routine patching and replacement can eliminate known instances of expired-pointer bugs.

PR.PS-06 partial match
blocks

Secure-development practices directly prevent coding errors such as use-after-free while one CWE contributes only modestly to the full control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
blocks

Secure development lifecycle practices can include pointer lifetime and memory-management rules that reduce expired-pointer dereferences.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including resilience against attacks such as buffer overflows or SQL injection) be identified and specified during development or acquisition; it does not itself stop an expired pointer dereference from being introduced or from remaining exploitable in the resulting application.

A.8.27 Secure system architecture and engineering principles partial match
blocks

A.8.27 establishes and applies secure-by-design principles, architecture reviews, and hardening that can surface or avoid many classes of memory errors, but it does not stop an already-written expired-pointer dereference from being exploitable; that requires code changes (removal) or runtime mitigations (e.g. ASLR, bounds checking) supplied by other controls.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly address pointer lifetime and deallocation discipline, substantially mitigating expired-pointer dereference.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect use-after-free issues, but removing this weakness alone does not fulfill the testing control.

A.8.32 Change management partial match
blocks

Change-management processes can require re-validation of memory safety after modifications, indirectly reducing the weakness.

References