CVE-2023-20086: Cisco ASA Software DoS Vulnerability

CVE-2023-20086 Overview

A denial of service vulnerability exists in the ICMPv6 processing functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. This vulnerability allows an unauthenticated, remote attacker to cause affected devices to reload by sending specially crafted ICMPv6 messages, resulting in service disruption for networks protected by these critical security appliances.

The vulnerability stems from improper processing of ICMPv6 messages within the affected software. When a targeted Cisco ASA or FTD system with IPv6 enabled receives malformed ICMPv6 packets, the device may crash and reload, temporarily disabling firewall protection and potentially exposing the network to additional threats during the outage period.

Critical Impact

Successful exploitation causes device reload, resulting in network security protection disruption and potential service outages for organizations relying on Cisco ASA or FTD for perimeter defense.

Affected Products

• Cisco Adaptive Security Appliance (ASA) Software versions 9.8.x through 9.19.1
• Cisco Firepower Threat Defense (FTD) Software versions 6.2.3 through 7.3.1.1
• All Cisco hardware appliances running vulnerable ASA or FTD software with IPv6 enabled

Discovery Timeline

• November 01, 2023 - CVE-2023-20086 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-20086

Vulnerability Analysis

This vulnerability affects the ICMPv6 protocol handler in Cisco ASA and FTD software. ICMPv6 is a fundamental protocol for IPv6 networks, handling functions such as neighbor discovery, router solicitation, and error reporting. The improper processing of these messages creates an opportunity for attackers to trigger an unhandled exception that causes the device to reload.

The vulnerability is classified under CWE-248 (Uncaught Exception), indicating that the software fails to properly handle exceptional conditions when processing malformed ICMPv6 packets. This leads to an uncontrolled system state that results in a device reload. The attack requires no authentication and can be executed remotely over the network, making it accessible to any attacker who can send IPv6 traffic to the target device.

Organizations using Cisco ASA or FTD as their primary perimeter security devices are at significant risk, as successful exploitation would temporarily disable firewall protection. This is particularly concerning for internet-facing devices that process IPv6 traffic from untrusted sources.

Root Cause

The root cause of CVE-2023-20086 is improper input validation and exception handling in the ICMPv6 message processing code. When the software receives a specially crafted ICMPv6 message, it encounters an unexpected condition that triggers an uncaught exception (CWE-248). Rather than gracefully handling the error and continuing operation, the exception propagates and causes the entire device to reload.

This type of vulnerability often occurs when edge cases in protocol parsing are not properly anticipated during development, or when error handling paths are incomplete. The ICMPv6 protocol specification allows for various message types and options, and the complexity of properly validating all possible combinations can lead to gaps in input validation.

Attack Vector

The attack vector for this vulnerability is network-based, requiring the attacker to send crafted ICMPv6 packets to a target Cisco ASA or FTD device. The attack has the following characteristics:

• Network Access Required: The attacker must be able to route IPv6 traffic to the target device
• No Authentication: The attack can be performed by an unauthenticated, remote attacker
• IPv6 Dependency: The target device must have IPv6 enabled on at least one interface
• Single Packet Potential: The device may reload upon receiving the malicious ICMPv6 message

The attack can be launched from anywhere on the internet if the device's IPv6 interface is reachable, or from within the network if the attacker has local access. Since ICMPv6 is typically permitted through firewalls for basic IPv6 functionality, filtering this traffic may not be straightforward without impacting legitimate IPv6 operations.

Detection Methods for CVE-2023-20086

Indicators of Compromise

• Unexpected device reloads with crash logs indicating ICMPv6 processing failures
• Syslog messages showing system crashes or watchdog timer expiration events
• High volume of ICMPv6 traffic from suspicious external sources preceding device reloads
• Repeated device reload patterns correlating with specific ICMPv6 traffic bursts

Detection Strategies

• Monitor Cisco ASA/FTD system logs for unexpected reload events and crash dump generation
• Implement network traffic analysis to detect anomalous ICMPv6 traffic patterns targeting security appliances
• Configure SNMP monitoring for device availability and uptime metrics with alerting on unexpected restarts
• Deploy intrusion detection rules to identify malformed ICMPv6 packets destined for management interfaces

Monitoring Recommendations

• Enable detailed logging on Cisco ASA/FTD devices to capture crash information and reload reasons
• Implement continuous availability monitoring with rapid alerting for device outages
• Review crash dump files from the show crashinfo command for evidence of ICMPv6-related failures
• Monitor for repeated reloads that could indicate ongoing exploitation attempts

How to Mitigate CVE-2023-20086

Immediate Actions Required

• Verify current ASA and FTD software versions against the Cisco Security Advisory to determine vulnerability status
• Plan and execute software upgrades to patched versions during the next available maintenance window
• Implement access control lists (ACLs) to restrict ICMPv6 traffic to trusted sources where possible
• Ensure device configurations are backed up and high availability configurations are functioning properly

Patch Information

Cisco has released software updates that address this vulnerability. Organizations should consult the Cisco Security Advisory cisco-sa-asa-icmpv6-t5TzqwNd for specific fixed software versions for their deployment. The advisory provides detailed information about affected and fixed releases for both ASA Software and Firepower Threat Defense Software.

When planning upgrades, organizations should:

• Identify all deployed ASA and FTD devices and their current software versions
• Determine the appropriate fixed software version for each device platform
• Test upgrades in a non-production environment if possible
• Schedule maintenance windows for production upgrades with appropriate rollback plans

Workarounds

• Disable IPv6 on interfaces where it is not required to eliminate the attack surface
• Implement strict ACLs to limit ICMPv6 traffic to only necessary sources and types
• Deploy upstream filtering to drop malformed ICMPv6 packets before they reach vulnerable devices
• Ensure high availability configurations are properly functioning to minimize impact from potential exploitation

# Example: Check current ASA software version
show version

# Example: Verify IPv6 interface configuration
show ipv6 interface brief

# Example: Review recent reload reasons
show crashinfo