CVE-2023-20269

Medium [CVE-2023-20269] vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user

CVE-2023-20269Source published Sep 6, 2023Source updated Oct 11, 2023

An unauthenticated remote attacker could exploit a flaw in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. The flaw is caused by improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Affected products named by the advisory: Secure Firewall Adaptive Security Appliance (ASA) Software; ASA…

Affected products in this advisory

• Secure Firewall Adaptive Security Appliance (ASA) Software
• ASA 5500-X Series Firewalls
• 3000 Series Industrial Security Appliances (ISA)
• Firepower 9000 Series

4 more entries in the full advisory.

Source-reported affected versions

• Scope: At the time of publication, this vulnerability affected Cisco devices if they were running a vulnerable release of Cisco ASA or FTD Software. The exact conditions to determine whether a device is vulnerable depend on the desired outcome, as detailed below.
• Release 7.0.6 (affected unless hot fix Cisco_FTD_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_Hotfix_EI-7.0.6.1-3.sh.REL.tar is installed)
• Release 7.2.5 (affected unless hot fix Cisco_FTD_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP3K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_Hotfix_BJ-7.2.5.1-1.sh.REL.tar is installed)
• Release 9.8 (affected; no hot fix is listed in this advisory)

15 more entries in the full advisory.

Source-reported fixed versions

• Release 7.0.6 — Cisco_FTD_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_Hotfix_EI-7.0.6.1-3.sh.REL.tar
• Release 7.2.5 — Cisco_FTD_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP3K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_Hotfix_BJ-7.2.5.1-1.sh.REL.tar

Mitigation guidance

• Install the Cisco hot fix listed for your FMC release train.
• Release 7.0.6: install Cisco_FTD_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_EI-7.0.6.1-3.sh.REL.tar / Cisco_FTD_SSP_Hotfix_EI-7.0.6.1-3.sh.REL.tar.
• Release 7.2.5: install Cisco_FTD_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP1K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP2K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_FP3K_Hotfix_BJ-7.2.5.1-1.sh.REL.tar / Cisco_FTD_SSP_Hotfix_BJ-7.2.5.1-1.sh.REL.tar.

Workarounds

• While there is no method to completely prevent a brute force attack attempt, you can implement the following recommendations to limit the impact of brute force attacks and to protect against unauthorized Clientless SSL VPN session establishment using the DefaultADMINGroup or DefaultL2LGroup connection profiles/tunnel groups.
• Brute Force Attacks
• Brute Force Attack Against the LOCAL User Database
• To counter brute force attacks against the LOCAL user database, limit the number of consecutive failed login attempts that the ASA allows for a given user in the LOCAL user database using the aaa local authentication attempts max-fail number command in global configuration mode.

6 more entries in the full advisory.