Cyber Resilience

CVE-2023-20212

Cisco Secure Endpoint ≤ 8.1.7.21585

Published
18 August 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.026 84th percentile
Risk Priority 62 floored blend · peak EPSS

Summary

CVE-2023-20212 is a high-severity Expired Pointer Dereference (CWE-825) vulnerability in Cisco Secure Endpoint. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 16% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an…

more

affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.

CWE(s)
CWE-825NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-20084Same product: Cisco Secure Endpoint
CVE-2025-20128Same product: Cisco Secure Endpoint
CVE-2025-20234Same product: Cisco Secure Endpoint
CVE-2024-20290Same product: Cisco Secure Endpoint
CVE-2025-20202Same vendor: Cisco
CVE-2024-20454Same vendor: Cisco
CVE-2023-20162Same vendor: Cisco
CVE-2024-20307Same vendor: Cisco
CVE-2025-20352Same vendor: Cisco
CVE-2025-20169Same vendor: Cisco

Affected Assets

cisco
secure endpoint
≤ 8.1.7.21585
cisco
secure endpoint private cloud
≤ 3.8.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices directly prevent coding errors such as use-after-free while one CWE contributes only modestly to the full control.

ID.AM-08 partial match
prevents

Lifecycle management includes secure development and maintenance phases that reduce memory-safety defects.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover use-after-free flaws via scanning or analysis.

PR.PS-02 partial match
prevents

Routine patching and replacement can eliminate known instances of expired-pointer bugs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect use-after-free issues, but removing this weakness alone does not fulfill the testing control.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle practices can include pointer lifetime and memory-management rules that reduce expired-pointer dereferences.

A.8.26 Application security requirements partial match
prevents

Application security requirements may mandate safe memory handling, but eliminating this single weakness does not satisfy the broader requirement.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture and engineering principles can prescribe memory-safety patterns, yet fixing only this weakness does not achieve the control.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly address pointer lifetime and deallocation discipline, substantially mitigating expired-pointer dereference.

A.8.32 Change management partial match
prevents

Change-management processes can require re-validation of memory safety after modifications, indirectly reducing the weakness.

References