The vulnerability of the Deterministic Random Bit Generator (DRBG), a microprogramming-based security technology used in Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD), allows attackers to obtain the secret key of the vulnerable device.

🗓️ 13 Apr 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Remote attacker can exploit DRBG with weak entropy in Cisco ASA and Firepower Threat Defense to obtain the secret key.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2023-20107	22 Mar 202323:00	–	attackerkb
Circl	CVE-2023-20107	23 Mar 202319:37	–	circl
Cisco	Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability	22 Mar 202316:00	–	cisco
Tenable Nessus	Cisco Adaptive Security Appliance Software Low Entropy Keys (cisco-sa-asa5500x-entropy-6v9bHVYP)	31 Mar 202300:00	–	nessus
Tenable Nessus	Cisco Firepower Threat Defense Software Low Entropy Keys (cisco-sa-asa5500x-entropy-6v9bHVYP)	31 Mar 202300:00	–	nessus
CNNVD	Cisco Adaptive Security Appliances Software 安全特征问题漏洞	23 Mar 202300:00	–	cnnvd
CVE	CVE-2023-20107	23 Mar 202300:00	–	cve
Cvelist	CVE-2023-20107 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability	23 Mar 202300:00	–	cvelist
EUVD	EUVD-2023-24286	3 Oct 202520:07	–	euvd
NVD	CVE-2023-20107	23 Mar 202317:15	–	nvd

Vulners

Node

cisco_systems firepower_threat_defenseRange<6.4.0

OR

cisco_systems adaptive_security_applianceRange<9.12.1

Source	Link
sec	www.sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa5500x-entropy-6v9bHVYP
web	www.web.nvd.nist.gov/view/vuln/detail

13 Apr 2023 00:00Current

CVSS 25

CVSS 35.3

EPSS0.00495

Weak entropy Key leakage Remote exploit Cisco appliances Random bit generator