Cisco ASA/Firepower Threat Defense up to 9.16 VPN improper authentication

Summaryinfo

A vulnerability was found in Cisco ASA and Firepower Threat Defense up to 9.16. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component VPN. This manipulation causes improper authentication. This vulnerability is handled as CVE-2023-20269. The attack can be initiated remotely. Additionally, an exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in Cisco ASA and Firepower Threat Defense up to 9.16 (Firewall Software). Affected by this vulnerability is an unknown code block of the component VPN. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect integrity. The summary by CVE is:

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.

The weakness was released 09/07/2023 as cisco-sa-asaftd-ravpn-auth-8LyfCkeC. The advisory is shared at sec.cloudapps.cisco.com. This vulnerability is known as CVE-2023-20269 since 10/27/2022. Technical details are unknown but an exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/28/2025).

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 09/13/2023 with a due date of 10/04/2023:

Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Zero-Day.cz (806). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• ASA
• Firepower Threat Defense

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7
• 9.8
• 9.9
• 9.10
• 9.11
• 9.12
• 9.13
• 9.14
• 9.15
• 9.16

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion