Skip to content
VulniPulse
Sign in
Medium5.0Cisco Exploited CISA KEV

Medium [CVE-2023-20269] vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user

This medium-severity Cisco advisory covers CVE-2023-20269 affecting Secure Firewall Adaptive Security Appliance (ASA) Software, ASA 5500-X Series Firewalls, 3000 Series Industrial Security Appliances (ISA).

CVE-2023-20269 Published Sep 6, 2023Updated by vendor Oct 11, 2023
CVE-2023-20269
Affected products & platforms
CiscoFirewallASA / FirepowerASA 5500
Open vendor advisory

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

An unauthenticated remote attacker could exploit a flaw in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.

The flaw is caused by improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier).

Affected products named by the advisory: Secure Firewall Adaptive Security Appliance (ASA) Software; ASA 5500-X Series Firewalls; 3000 Series Industrial Security Appliances (ISA); Firepower 9000 Series; and 4 more.

Affected products named by the advisory: Firepower 4100 Series; Adaptive Security Virtual Appliance (ASAv); Firepower 2100 Series; Firepower 1000 Series.

CISA Known Exploited Vulnerability

Listed:
Sep 13, 2023 · federal remediation due Oct 4, 2023
Required action:
Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.
Ransomware use:
Known

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions
  • Scope: At the time of publication, this vulnerability affected Cisco devices if they were running a vulnerable release of Cisco ASA or FTD Software. The exact conditions to determine whether a device is vulnerable depend on the desired outcome, as detailed below.
  • Release 7.0.6 (affected unless hot fix Cisco_FTD_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_Hotfix_EI-7.0.6.1-3.sh.REL.tar is installed)
  • Release 7.2.5 (affected unless hot fix Cisco_FTD_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP3K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_Hotfix_BJ-7.2.5.1-1.sh.REL.tar is installed)
  • Release 9.8 (affected; no hot fix is listed in this advisory)
  • Release 9.12 (affected; no hot fix is listed in this advisory)
  • Release 9.14 (affected; no hot fix is listed in this advisory)
  • Release 9.16 (affected; no hot fix is listed in this advisory)
  • Release 9.17 (affected; no hot fix is listed in this advisory)
  • Release 9.18 (affected; no hot fix is listed in this advisory)
  • Release 9.19 (affected; no hot fix is listed in this advisory)
  • Release 9.20 (affected; no hot fix is listed in this advisory)
  • Release 6.6 (affected; no hot fix is listed in this advisory)
  • Release 6.2 (affected; no hot fix is listed in this advisory)
  • Release 6.4 (affected; no hot fix is listed in this advisory)
  • Release 7.0 (affected; no hot fix is listed in this advisory)
  • Release 7.1 (affected; no hot fix is listed in this advisory)
  • Release 7.2 (affected; no hot fix is listed in this advisory)
  • Release 7.3 (affected; no hot fix is listed in this advisory)
  • Release 7.4 (affected; no hot fix is listed in this advisory)

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Fixed versions
  • Release 7.0.6 — Cisco_FTD_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_Hotfix_EI-7.0.6.1-3.sh.REL.tar
  • Release 7.2.5 — Cisco_FTD_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP3K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_Hotfix_BJ-7.2.5.1-1.sh.REL.tar

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Install the Cisco hot fix listed for your FMC release train.
  • Release 7.0.6: install Cisco_FTD_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_Hotfix_EI-7.0.6.1-3.sh.REL.tar.
  • Release 7.2.5: install Cisco_FTD_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP3K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_Hotfix_BJ-7.2.5.1-1.sh.REL.tar.
Temporary workarounds
  • While there is no method to completely prevent a brute force attack attempt, you can implement the following recommendations to limit the impact of brute force attacks and to protect against unauthorized Clientless SSL VPN session establishment using the DefaultADMINGroup or DefaultL2LGroup connection profiles/tunnel groups.
  • Brute Force Attacks
  • Brute Force Attack Against the LOCAL User Database
  • To counter brute force attacks against the LOCAL user database, limit the number of consecutive failed login attempts that the ASA allows for a given user in the LOCAL user database using the aaa local authentication attempts max-fail number command in global configuration mode.
  • After a user makes the configured number of consecutive login attempts with a wrong password, the user is locked out and cannot log in successfully until the administrator either manually unlocks the user using the clear aaa local user lockout username username command or (when running Cisco ASA Software releases 9.17 and later) until 10 minutes pass. Locking or unlocking a username results in …
  • %ASA-6-113006: User 'test' locked out on exceeding '5' successive failed authentication attempts
  • %ASA-6-113007: User 'test' unlocked by 'enable_15'
  • Note: In Cisco ASA Software releases 9.16 and earlier, this feature does not apply to users with privilege level 15.
  • For further information on this feature, refer to the Cisco Secure Firewall ASA Series Command Reference.
  • Brute Force Attacks Against an External User Database

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.