CVE-2023-20269
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
Description
CVE-2023-20269 is a vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software that enables authentication bypass through improper separation of AAA functions. The flaw allows an unauthenticated, remote attacker to conduct brute force attacks against VPN credentials, or an authenticated attacker to establish unauthorized clientless SSL VPN sessions. This occurs because the authentication mechanisms between the remote access VPN feature and HTTPS management or site-to-site VPN features are not properly separated. CVE-2023-20269 is listed in CISA's Known Exploited Vulnerabilities catalog and has been associated with ransomware campaigns, making immediate remediation critical for organizations running affected Cisco ASA or FTD deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | adaptive security appliance software | 9.8.1; 9.8.1.5; 9.8.1.7; 9.8.2; 9.8.2.8; 9.8.2.14; 9.8.2.15; 9.8.2.17; 9.8.2.20; 9.8.2.24; 9.8.2.26; 9.8.2.28; 9.8.2.33; 9.8.2.35; 9.8.2.38; 9.8.3; 9.8.3.8; 9.8.3.11; 9.8.3.14; 9.8.3.16; 9.8.3.18; 9.8.3.21; 9.8.3.26; 9.8.3.29; 9.8.4; 9.8.4.3; 9.8.4.7; 9.8.4.8; 9.8.4.10; 9.8.4.12; 9.8.4.15; 9.8.4.17; 9.8.4.20; 9.8.4.22; 9.8.4.25; 9.8.4.26; 9.8.4.29; 9.8.4.32; 9.8.4.33; 9.8.4.34; 9.8.4.35; 9.8.4.39; 9.8.4.40; 9.8.4.41; 9.8.4.43; 9.8.4.44; 9.8.4.45; 9.8.4.46; 9.8.4.48; 9.12.1; 9.12.1.2; 9.12.1.3; 9.12.2; 9.12.2.1; 9.12.2.4; 9.12.2.5; 9.12.2.9; 9.12.3; 9.12.3.2; 9.12.3.7; 9.12.3.9; 9.12.3.12; 9.12.4; 9.12.4.2; 9.12.4.4; 9.12.4.7; 9.12.4.8; 9.12.4.10; 9.12.4.13; 9.12.4.18; 9.12.4.24; 9.12.4.26; 9.12.4.29; 9.12.4.30; 9.12.4.35; 9.12.4.37; 9.12.4.38; 9.12.4.39; 9.12.4.40; 9.12.4.41; 9.12.4.47; 9.12.4.48; 9.12.4.50; 9.12.4.52; 9.12.4.54; 9.12.4.55; 9.12.4.56; 9.12.4.58; 9.14.1; 9.14.1.6; 9.14.1.10; 9.14.1.15; 9.14.1.19; 9.14.1.30; 9.14.2; 9.14.2.4; 9.14.2.8; 9.14.2.13; 9.14.2.15; 9.14.3; 9.14.3.1; 9.14.3.9; 9.14.3.11; 9.14.3.13; 9.14.3.15; 9.14.3.18; 9.14.4; 9.14.4.6; 9.14.4.7; 9.14.4.12; 9.14.4.13; 9.14.4.14; 9.14.4.15; 9.14.4.17; 9.14.4.22; 9.14.4.23; 9.15.1; 9.15.1.1; 9.15.1.7; 9.15.1.10; 9.15.1.15; 9.15.1.16; 9.15.1.17; 9.15.1.21; 9.16.1; 9.16.1.28; 9.16.2; 9.16.2.3; 9.16.2.7; 9.16.2.11; 9.16.2.13; 9.16.2.14; 9.16.3; 9.16.3.3; 9.16.3.14; 9.16.3.15; 9.16.3.19; 9.16.3.23; 9.16.4; 9.16.4.9; 9.16.4.14; 9.16.4.18; 9.16.4.19; 9.16.4.27; 9.16.4.38; 9.17.1; 9.17.1.7; 9.17.1.9; 9.17.1.10; 9.17.1.11; 9.17.1.13; 9.17.1.15; 9.17.1.20; 9.17.1.30; 9.18.1; 9.18.1.3; 9.18.2; 9.18.2.5; 9.18.2.7; 9.18.2.8; 9.18.3; 9.18.3.39; 9.18.3.46; 9.18.3.53; 9.18.3.55; 9.19.1; 9.19.1.5; 9.19.1.9; 9.19.1.12; 9.19.1.18 |
| cisco | secure firewall threat defense | 6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; 6.2.3.6; 6.2.3.7; 6.2.3.8; 6.2.3.9; 6.2.3.10; 6.2.3.11; 6.2.3.12; 6.2.3.13; 6.2.3.14; 6.2.3.15; 6.2.3.16; 6.2.3.17; 6.2.3.18; 6.4.0; 6.4.0.1; 6.4.0.2; 6.4.0.3; 6.4.0.4; 6.4.0.5; 6.4.0.6; 6.4.0.7; 6.4.0.8; 6.4.0.9; 6.4.0.10; 6.4.0.11; 6.4.0.12; 6.4.0.13; 6.4.0.14; 6.4.0.15; 6.4.0.16; 6.6.0; 6.6.0.1; 6.6.1; 6.6.3; 6.6.4; 6.6.5; 6.6.5.1; 6.6.5.2; 6.6.7; 6.6.7.1; 6.7.0; 6.7.0.1; 6.7.0.2; 6.7.0.3; 7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.0.2.1; 7.0.3; 7.0.4; 7.0.5; 7.0.6; 7.1.0; 7.1.0.1; 7.1.0.2; 7.1.0.3; 7.2.0; 7.2.0.1; 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.4.1; 7.2.5; 7.3.0; 7.3.1; 7.3.1.1; 7.4.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CVE-2023-20269 exploits an alternate authentication path in Cisco ASA and FTD software, where default connection profiles and tunnel groups can be leveraged to bypass intended access controls on the remote access VPN feature. This weakness allows attackers to interact with authentication mechanisms through an unintended channel.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
CWE-863: Incorrect Authorization
The vulnerability also involves incorrect authorization in how Cisco ASA and FTD software separates AAA functions between different VPN features. The improper authorization boundary allows authenticated users to establish clientless SSL VPN sessions with unauthorized user contexts.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2023-20269 is remotely exploitable without physical access and requires low attack complexity, meaning no special conditions are needed for exploitation. While low-level privileges are required for the unauthorized session establishment attack path, the brute force credential discovery path requires no authentication at all and no user interaction. Scope (Changed): this vulnerability can affect resources beyond the vulnerable VPN component itself, potentially enabling attackers to pivot into internal networks once valid credentials are obtained. Integrity (Low): a successful exploit allows unauthorized modifications to VPN session state, though confidentiality and availability are not directly impacted by the vulnerability itself. With a CVSS score of 5.0 (Medium), the direct technical impact is moderate, but the real-world risk is significantly elevated because CISA has confirmed active exploitation and ransomware operators are known to leverage this vulnerability as an initial access vector for network intrusion campaigns.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-20269 in the wild, and this vulnerability is known to have been used in ransomware campaigns targeting organizations with exposed Cisco ASA and FTD VPN endpoints. The EPSS score of 0.88% places this vulnerability in the 75th percentile, indicating a moderate probability of exploitation activity, though the confirmed real-world use by ransomware groups demonstrates that threat actors are actively targeting this flaw. Cisco has published a security advisory with detailed mitigation guidance, and organizations should treat this as a high-priority remediation item given the ransomware association.
Remediation
- Apply mitigations per Cisco's advisory: Follow the vendor-recommended workarounds and mitigations detailed in cisco-sa-asaftd-ravpn-auth-8LyfCkeC, including applying software updates when available for Cisco ASA Software and Cisco Firepower Threat Defense Software. CISA required remediation by October 4, 2023.
- Restrict default connection profiles: Disable or lock down default tunnel groups and connection profiles on Cisco ASA and FTD appliances to prevent their use as an alternate authentication path. Configure explicit connection profiles with proper authorization controls for all remote access VPN users.
- Enforce multi-factor authentication (MFA): Implement MFA on all remote access VPN connections to mitigate the risk of brute force credential attacks. Even if valid credentials are discovered, MFA provides an additional authentication barrier.
- Monitor VPN authentication logs: Review authentication logs on ASA and FTD appliances for signs of brute force activity, including high volumes of failed login attempts, attempts to use default connection profiles, and unauthorized clientless SSL VPN session establishment.
- Implement network-level access controls: Restrict which IP addresses can reach the VPN management interface using access control lists (ACLs). Deploy rate limiting on VPN authentication endpoints to slow brute force attempts, and segment VPN access from critical internal resources.
Technical Details
CVE-2023-20269 stems from improper separation of authentication, authorization, and accounting (AAA) between different VPN features in Cisco ASA and FTD software, classified under both CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-863 (Incorrect Authorization). The vulnerability exists in how default connection profiles and tunnel groups handle authentication requests — an attacker can specify a default connection profile when conducting a brute force attack against the remote access VPN, effectively using an alternate authentication channel that lacks proper rate limiting and access restrictions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) indicates that while the attack is network-based with low complexity and requires no user interaction, it does need low-level privileges for the session establishment path, and critically the scope is changed, meaning exploitation can impact resources beyond the vulnerable component. The two CWE classifications are complementary: CWE-288 describes the alternate path through default profiles that bypasses intended access controls, while CWE-863 describes the incorrect authorization that permits authenticated users to establish VPN sessions under unauthorized user contexts when running Cisco ASA Software Release 9.16 or earlier.
Frequently Asked Questions
Is CVE-2023-20269 being actively exploited?
Yes, CVE-2023-20269 is actively exploited in the wild. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, and it has been specifically associated with ransomware campaigns targeting organizations with exposed Cisco ASA and FTD VPN endpoints.
What products are affected by CVE-2023-20269?
CVE-2023-20269 affects Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The clientless SSL VPN session establishment attack path specifically impacts Cisco ASA Software Release 9.16 or earlier.
How do I fix CVE-2023-20269?
Apply the mitigations and software updates detailed in Cisco's security advisory cisco-sa-asaftd-ravpn-auth-8LyfCkeC. Key steps include disabling default connection profiles, enforcing multi-factor authentication on VPN connections, and monitoring authentication logs for brute force activity.
How severe is CVE-2023-20269?
CVE-2023-20269 has a CVSS score of 5.0 (Medium severity) with a changed scope, indicating potential impact beyond the vulnerable component. While the technical severity is moderate, the real-world risk is elevated due to confirmed active exploitation by ransomware operators and its inclusion in CISA's KEV catalog with a remediation deadline of October 4, 2023.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.