What is CVE-2023-20269?

CVE-2023-20269 is a vulnerability found in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. This vulnerability could allow an attacker to conduct a brute force attack to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user. The issue stems from improper separation of authentication, authorization, and accounting (AAA) between different VPN features.

Who is impacted by this?

A wide range of software versions are impacted, including ASA Software versions from 6.2.3 to 9.19.1.18 and FTD Software versions from 6.2.3 to 9.19.1.18. The severity of this vulnerability is not yet provided, and it affects various versions of Cisco ASA and FTD software, indicating a broad impact across different deployments of these software versions.

What should I do if I’m affected?

If you're affected by the CVE-2023-20269 vulnerability, it's crucial to take action to mitigate the risk. Here's a simplified step-by-step guide:

1. Identify if your organization uses the affected Cisco ASA or FTD software versions.

2. Monitor official sources, such as the National Vulnerability Database, for updates on the vulnerability's severity and potential patches.

3. Implement a robust vulnerability management process, as suggested by CISA's BOD 22-01.

4. Stay informed about known exploited vulnerabilities through resources like the CISA catalog.

5. Consult with your IT team or vendor for specific guidance on addressing the vulnerability in your organization's systems.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability (CVE-2023-20269) is indeed present in CISA's Known Exploited Vulnerabilities Catalog. It was added on September 13, 2023, and the due date for required action is October 4, 2023. Organizations affected by this vulnerability must apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue the use of the product for unsupported devices.

Weakness Enumeration

The weakness enumeration for this vulnerability includes CWE-863 Incorrect Authorization and CWE-288 Authentication Bypass Using an Alternate Path or Channel.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and affected software configurations, refer to the National Vulnerability Database or the resources listed below.

• Cisco Security Advisory

• CISA's BOD 22-01

• CISA's Known Exploited Vulnerabilities Catalog