Cisco Firepower Threat Defense Software Low Entropy Keys (cisco-sa-asa5500x-entropy-6v9bHVYP)

medium Nessus Plugin ID 173731


The remote device is missing a vendor-supplied security patch


A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG) in Cisco Firepower Threat Defense (FTD) Software for Cisco ASA 5506-X, ASA-5508-X and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device.

Note that devices running a fixed version of Cisco FTD Software may also be affected if they are configured with an ECDSA or RSA key pair that has been generated while running an affected release. If there is doubt, Cisco recommends regenerating all ECDSA and RSA key pairs that are configured on the device.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.


Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvm90511

See Also

Plugin Details

Severity : Medium

ID : 173731

File Name : cisco-sa-asa5500x-entropy-6v9bHVYP-ftd.nasl

Version : 1.0

Type : local

Family : CISCO

Published : 3/31/2023

Updated : 3/31/2023

Configuration : Enable paranoid mode

Risk Information


Risk Factor : Medium

Score : 4.4


Risk Factor : Medium

Base Score : 5

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source : CVE-2023-20107


Risk Factor : Medium

Base Score : 5.3

Vector : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Vulnerability Information

CPE : cpe:/a:cisco:firepower_threat_defense

Required KB Items : installed_sw/Cisco Firepower Threat Defense , Settings/ParanoidReport

Patch Publication Date : 2/22/2023

Vulnerability Publication Date : 3/22/2023

Reference Information

CVE : CVE-2023-20107


CISCO-SA : cisco-sa-asa5500x-entropy-6v9bHVYP

IAVA : 2023-A-0165

CWE : 20