Vulnerability in Cisco Adaptive Security Appliance SSL VPN Feature

CVE-2023-20275

Summary

An issue exists within the SSL VPN feature of Cisco's Adaptive Security Appliance and Firepower Threat Defense software that allows an authenticated remote attacker to craft packets with another VPN user's source IP address due to insufficient validation of the packet's inner source IP after decryption. Exploitation enables an attacker to send packets that mimic another user's IP address, creating a potential for unauthorized actions, although the attacker does not receive any return packets.

References