CVE-2023-20269
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
Cisco Adaptive Security Appliance and Firepower Threat Defense
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not po
Ransomware groups exploiting CVE-2023-20269
The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group. It's worth noting that with the end of CONTI's operation, several affiliates migrated to independent campaigns s
Exploitation is attributed to these groups across their recorded activity. It does not follow that every organisation they listed was reached through CVE-2023-20269 — the source data does not record an entry point per incident.
Exploitation status
CISA Known Exploited Vulnerabilities
Listed by CISA on 13 September 2023. US federal agencies were required to remediate it by 4 October 2023. CISA records this vulnerability as known to be used in ransomware campaigns.
EPSS — exploitation probability
FIRST puts the probability of exploitation activity in the next 30 days at 21.6%, which is higher than 97.4% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Recent listings by these groups
Disclosures from the groups above, newest first.
Frequently asked questions
Is CVE-2023-20269 being exploited by ransomware groups?
Yes. CVE-2023-20269 is recorded as exploited by Akira. Between them these groups account for 1,407 victim disclosures in this database. CISA also records this vulnerability as used in ransomware campaigns.
What does CVE-2023-20269 affect?
CVE-2023-20269 affects Cisco Adaptive Security Appliance and Firepower Threat Defense. A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not po
How severe is CVE-2023-20269?
CVE-2023-20269 is rated MEDIUM with a CVSS base score of 5. EPSS puts the probability of exploitation in the next 30 days at 21.6%, higher than 97.4% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 4 October 2023.
How should organisations respond to CVE-2023-20269?
Apply the vendor patch for Cisco Adaptive Security Appliance and Firepower Threat Defense as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.