Cisco ASA Improper Resource Shutdown or Release (CVE-2023-20042)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506052);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_cve_id("CVE-2023-20042");

  script_name(english:"Cisco ASA Improper Resource Shutdown or Release (CVE-2023-20042)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive
Security Appliance (ASA) Software and Cisco Firepower Threat Defense
(FTD) Software could allow an unauthenticated, remote attacker to
cause a denial of service (DoS) condition on an affected device. This
vulnerability is due to an implementation error within the SSL/TLS
session handling process that can prevent the release of a session
handler under specific conditions. An attacker could exploit this
vulnerability by sending crafted SSL/TLS traffic to an affected
device, increasing the probability of session handler leaks. A
successful exploit could allow the attacker to eventually deplete the
available session handler pool, preventing new sessions from being
established and causing a DoS condition.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ssl-dos-kxG8mpUA
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2e7bf9f2");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-20042");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(404);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/11/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/11/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.1.28");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.2.11");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.2.13");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.2.14");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.2.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.2.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.3.14");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.3.15");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.3.19");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.3.23");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.16.4.9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.11");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.13");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.15");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.20");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.18.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.18.1.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.18.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.18.2.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.18.2.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.19.1");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.1" :
        {"versionEndIncluding" : "9.16.1", "versionStartIncluding" : "9.16.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.1.28" :
        {"versionEndIncluding" : "9.16.1.28", "versionStartIncluding" : "9.16.1.28", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.2" :
        {"versionEndIncluding" : "9.16.2", "versionStartIncluding" : "9.16.2", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.2.3" :
        {"versionEndIncluding" : "9.16.2.3", "versionStartIncluding" : "9.16.2.3", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.2.7" :
        {"versionEndIncluding" : "9.16.2.7", "versionStartIncluding" : "9.16.2.7", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.2.11" :
        {"versionEndIncluding" : "9.16.2.11", "versionStartIncluding" : "9.16.2.11", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.2.13" :
        {"versionEndIncluding" : "9.16.2.13", "versionStartIncluding" : "9.16.2.13", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.2.14" :
        {"versionEndIncluding" : "9.16.2.14", "versionStartIncluding" : "9.16.2.14", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.3" :
        {"versionEndIncluding" : "9.16.3", "versionStartIncluding" : "9.16.3", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.3.3" :
        {"versionEndIncluding" : "9.16.3.3", "versionStartIncluding" : "9.16.3.3", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.3.14" :
        {"versionEndIncluding" : "9.16.3.14", "versionStartIncluding" : "9.16.3.14", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.3.15" :
        {"versionEndIncluding" : "9.16.3.15", "versionStartIncluding" : "9.16.3.15", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.3.19" :
        {"versionEndIncluding" : "9.16.3.19", "versionStartIncluding" : "9.16.3.19", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.3.23" :
        {"versionEndIncluding" : "9.16.3.23", "versionStartIncluding" : "9.16.3.23", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.4" :
        {"versionEndIncluding" : "9.16.4", "versionStartIncluding" : "9.16.4", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.4.9" :
        {"versionEndIncluding" : "9.16.4.9", "versionStartIncluding" : "9.16.4.9", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1" :
        {"versionEndIncluding" : "9.17.1", "versionStartIncluding" : "9.17.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.7" :
        {"versionEndIncluding" : "9.17.1.7", "versionStartIncluding" : "9.17.1.7", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.9" :
        {"versionEndIncluding" : "9.17.1.9", "versionStartIncluding" : "9.17.1.9", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.10" :
        {"versionEndIncluding" : "9.17.1.10", "versionStartIncluding" : "9.17.1.10", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.11" :
        {"versionEndIncluding" : "9.17.1.11", "versionStartIncluding" : "9.17.1.11", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.13" :
        {"versionEndIncluding" : "9.17.1.13", "versionStartIncluding" : "9.17.1.13", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.15" :
        {"versionEndIncluding" : "9.17.1.15", "versionStartIncluding" : "9.17.1.15", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.20" :
        {"versionEndIncluding" : "9.17.1.20", "versionStartIncluding" : "9.17.1.20", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18.1" :
        {"versionEndIncluding" : "9.18.1", "versionStartIncluding" : "9.18.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18.1.3" :
        {"versionEndIncluding" : "9.18.1.3", "versionStartIncluding" : "9.18.1.3", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18.2" :
        {"versionEndIncluding" : "9.18.2", "versionStartIncluding" : "9.18.2", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18.2.5" :
        {"versionEndIncluding" : "9.18.2.5", "versionStartIncluding" : "9.18.2.5", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18.2.7" :
        {"versionEndIncluding" : "9.18.2.7", "versionStartIncluding" : "9.18.2.7", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.19.1" :
        {"versionEndIncluding" : "9.19.1", "versionStartIncluding" : "9.19.1", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);