CVE-2023-20269KEV · OVERDUECWE-288CWE-863broken-access-control

Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

Medium · published September 6, 2023

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 5.0. It is confirmed in active exploitation. It sits in the 97.9th percentile for exploit probability.

1116
days past CISA
deadline
CVSS v3.1
5.0
EPSS
25%
Percentile
97.9
In the wild
Confirmed
What it is

⚠️ Watch out! A sneaky flaw in Cisco’s remote access VPN could let attackers try their luck at guessing passwords without breaking a sweat! Imagine a front desk at a hotel that’s poorly designed — when someone tries to check in, they can guess the room number without ever needing a keycard. Similarly, this vulnerability allows attackers to perform brute force attempts on user credentials without proper safeguards. An unauthenticated attacker could exploit this vulnerability to uncover valid username and password combinations, paving the way for unauthorized access to your VPN. In the worst-case scenario, a successful attack could lead to an unauthorized remote access session, potentially exposing sensitive data.

Put simply

Imagine a front desk at a hotel that’s poorly designed — when someone tries to check in, they can guess the room number without ever needing a keycard. Similarly, this vulnerability allows attackers to perform brute force attempts on user credentials without proper safeguards. This vulnerability arises from improper separation of authentication, authorization, and accounting (AAA) in the Cisco ASA and FTD VPN features, enabling brute force attacks against user credentials while using default connection profiles.

What to do

An unauthenticated attacker could exploit this vulnerability to uncover valid username and password combinations, paving the way for unauthorized access to your VPN. In the worst-case scenario, a successful attack could lead to an unauthorized remote access session, potentially exposing sensitive data. To protect your network, update to the latest Cisco ASA and FTD software versions as soon as available. In the meantime, consider implementing account lockout policies or stronger authentication mechanisms to mitigate brute force attempts. You've got this! With the right updates and measures, you can secure your VPN and keep those pesky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.25453 · 97.9th percentile
Weaknesses
CWE-288 · Authentication Bypass Using an Alternate Path or Channel; CWE-863 · Incorrect Authorization
Published
2023-09-06T22:15Z
KEV added
2023-09-13 · due 2023-10-04
Affected products (246)
ProductVersionsFixed in
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/adaptive_security_appliance_softwareall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
References (3)
EPSS history
Timeline
  • 13 SEP 00:00Z
    Added to CISA KEV — remediate by Oct 4
    kev
  • 06 SEP 17:09Z
    A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could…
    cvelistv5