Skip to content
Fencer Vulns
medium 5.0

CVE-2023-20269 kev+ ransomware in the critical feed json

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FT…

published 2023-09-06 3 y ago modified 2026-08-11 2 mo ago also EUVD-2023-24448

cvss
5.0
version 3.1, CNA
cisa kev
Exploited
added 2023-09-13, used in ransomware
epss
26.6%
EPSS 26.6% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.

Patch / fix

cisa required action Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.

Timeline

  1. Published
  2. CISA SSVC: exploitation active
  3. Added to CISA KEV
  4. CISA patch deadline

Known exploited

Added
3 y ago
Patch by
2023-10-04 (3 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.
Vendor, product
Cisco, Adaptive Security Appliance and Firepower Threat Defense
CISA name
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

  • Akira ransomware gang

reported by sec.cloudapps.cisco.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1133 External Remote Services exploitation
  • T1078 Valid Accounts primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
partial
Assessed
3 y ago

Exploit prediction

26.62% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

  • Cisco Cisco Adaptive Security Appliance (ASA) Software
  • Cisco Cisco Firepower Threat Defense Software

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel
  • CWE-863 Incorrect Authorization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.