How severe is CVE-2023-20084?

CVE-2023-20084 has a CVSS 3.x base score of 5.0, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2023-20084 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-20084?

CVE-2023-20084 primarily affects Cisco Secure Endpoint. In total, 35 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-20084?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-20084 published?

CVE-2023-20084 was published on 2023-11-22 and last updated on 2026-06-17.

CVE-2023-20084

CVE-2023-20084 is a medium-severity vulnerability in Cisco Secure Endpoint with a CVSS 3.x base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-437.

Key facts

Severity: Medium (CVSS 3.x base score 5.0)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-437
Affected product: Cisco Secure Endpoint
Published: 2023-11-22
Last modified: 2026-06-17

Description

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could exploit this vulnerability by persuading a user to put a malicious file into a specific folder and then persuading the user to execute the file within a limited time window. A successful exploit could allow the attacker to cause the endpoint software to fail to quarantine the malicious file or kill its process. Note: This vulnerability only applies to deployments that have the Windows Folder Redirection feature enabled.

Frequently asked questions

What is CVE-2023-20084?: A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could exploit this vulnerability by persuading a user to put a malicious file into a specific folder and then persuading the user to execute the file within a limited time window. A successful exploit could allow the attacker to cause the endpoint software to fail to quarantine the malicious file or kill its process. Note: This vulnerability only applies to deployments that have the Windows Folder Redirection feature enabled.
How severe is CVE-2023-20084?: CVE-2023-20084 has a CVSS 3.x base score of 5.0, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2023-20084 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-20084?: CVE-2023-20084 primarily affects Cisco Secure Endpoint. In total, 35 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-20084?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-20084 published?: CVE-2023-20084 was published on 2023-11-22 and last updated on 2026-06-17.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-endpoint-dos-RzOgFKnd

Affected products (35)

cpe:2.3:a:cisco:secure_endpoint:-:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.0.7:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.0.9:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.1.5:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.1.7:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.1.9:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.2.1:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.2.3:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.2.5:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.2.9:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.2.19:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.3.1:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.3.3:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.3.5:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:6.3.7:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.0.5:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.1.1:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.1.5:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.2.3:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.2.5:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.2.7:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.2.11:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.2.13:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.3.1:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.3.3:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.3.5:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:7.3.9:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:8.1.3:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:8.1.3.21242:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:8.1.5:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:8.1.5.21322:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:8.1.7:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:8.1.7.21417:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:8.1.7.21512:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:*

More vulnerabilities in Cisco Secure Endpoint

CVE-2023-20032 — Critical (CVSS 9.8): On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the…
CVE-2022-20770 — High (CVSS 8.6): On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2…
CVE-2026-20215 — High (CVSS 7.5): A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS…
CVE-2026-20214 — High (CVSS 7.5): A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS…
CVE-2026-20213 — High (CVSS 7.5): A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS…
CVE-2024-20290 — High (CVSS 7.5): A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a…

All CVEs affecting Cisco Secure Endpoint →

Other CWE-437 vulnerabilities

CVE-2024-57176 — High (CVSS 7.6): An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal…

Browse all CWE-437 vulnerabilities →