CVE-2023-20212

highpriority · track · 31EPSS 0.034 · 89 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

3.44% (89th) EPSS

CVSS 7.5 · high

Is it mine?

26 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco Secure Endpointcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · psirt@cisco.com USexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Cisco PSIRT US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-404USCWE-825US

affected products (26)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Cisco Secure Endpoint <1.22.0 (Linux)all versionscert_bundDE
Cisco Secure Endpoint <1.22.0 (MacOS)all versionscert_bundDE
Cisco Secure Endpoint <8.1.7.215851 (Windows)all versionscert_bundDE
Cisco Secure Endpoint <Private Cloud 3.8.0all versionscert_bundDE
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
Open Source ClamAV <0.103.9all versionscert_bundDE
Open Source ClamAV <1.0.2all versionscert_bundDE
Open Source ClamAV <1.1.1all versionscert_bundDE
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Cisco Secure Endpoint< 1.22.0 (Linux)cert_bundDE
Cisco Secure Endpoint< 1.22.0 (MacOS)cert_bundDE
Cisco Secure Endpoint< 8.1.7.215851 (Windows)cert_bundDE
Cisco Secure Endpoint< Private Cloud 3.8.0cert_bundDE
Open Source ClamAV< 0.103.9cert_bundDE
Open Source ClamAV< 1.0.2cert_bundDE
Open Source ClamAV< 1.1.1cert_bundDE

showing 20 of 26

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-2090ClamAV & Cisco Secure Endpoint: Mehrere SchwachstellenDeutsch2023-08-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ClamAV und Cisco Secure Endpoint ausnutzen, um einen Denial of Service Angriff durchzuführen.
cisco-sa-clamav-dos-FTkhqMWZClamAV AutoIt Module Denial of Service Vulnerability2023-08-16csaf · cisco_csafUS
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/2023/07/2023-08-16-releases.html"].

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisco_csaf NVD CVE.org MITRE

published 2023-08-18modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan