Cisco ASA and FTD Remote Access VPN Unauthorized Access and Brute Force Vulnerability (CVE-2023-20269) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTRemote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software.
Improper AAA separation allows unauthenticated remote attackers to conduct brute-force attacks to identify valid credentials or establish unauthorized clientless SSL VPN sessions.
Apply official software updates from Cisco, or implement workarounds by redirecting default connection profile authentication to a loopback address and enforcing MFA.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade to the latest Cisco-recommended patched release. Verify your current version and apply the update via the ASA CLI as follows:
# Verify current ASA software version
show version | include Software
# Download the patched image from TFTP and set the boot path
copy tftp://10.1.1.100/asa918-4-lts.bin flash:/asa918-4-lts.bin
configure terminal
boot system flash:/asa918-4-lts.bin
write memory
reload2. Temporary Workaround & Hardening Configuration
If patching cannot be immediately scheduled, mitigate brute-force attempts by redirecting authentication requests for default profiles to a non-existent dummy AAA server.
# 1. Create a dummy AAA server group pointing to loopback
aaa-server DUMMY_AAA protocol radius
aaa-server DUMMY_AAA host 127.0.0.1
key dummy_key
# 2. Map default connection profiles to the dummy AAA group
tunnel-group DefaultWEBVPNGroup general-attributes
authentication-server-group DUMMY_AAA
tunnel-group DefaultRAGroup general-attributes
authentication-server-group DUMMY_AAA3. Log Audit & IoC Verification Commands
Monitor ASA syslog messages for high-frequency authentication failures indicating active brute-force campaigns.
# Search for high-volume VPN authentication failure logs
show log | include %ASA-6-113015|%ASA-3-713048
# Inspect active clientless SSL VPN sessions
show vpn-sessiondb detail clientlessStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-20269) exists in the remote access VPN (RAVPN) feature of Cisco ASA and FTD Software. The root cause is the improper separation of Authentication, Authorization, and Accounting (AAA) services between the RAVPN feature, the HTTPS management interface, and site-to-site VPN features. This architectural flaw allows authentication requests targeting default connection profiles to bypass intended isolation boundaries.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated, remote attacker can exploit this vulnerability by targeting default connection profiles/tunnel groups (such as 'DefaultWEBVPNGroup' or 'DefaultRAGroup'). By executing brute-force attacks against these profiles, the attacker can systematically identify valid username and password combinations. Furthermore, an attacker possessing valid credentials can establish an unauthorized clientless SSL VPN session on Cisco ASA Software running release 9.16 or earlier. Note that establishing client-based VPN tunnels (e.g., AnyConnect) is not possible via this vector due to the lack of IP address pool configurations on default profiles.
3. Infrastructure & Business Impact
With a CVSS score of 9.1 (Critical) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability represents an active threat vector utilized by sophisticated threat actors. Successful exploitation allows attackers to gain initial access to internal corporate networks, serving as a primary entry point for subsequent lateral movement, ransomware deployment, and sensitive data exfiltration.
Official Vendor Advisories & References
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.
Frequently Asked SecOps Questions (CVE-2023-20269)
FAQQ1. How critical is CVE-2023-20269 and is it actively exploited in the wild?
CVE-2023-20269 is rated CVSS 9.1 (CRITICAL) with a 30-day EPSS exploitation probability of 26.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-20269?
Primary impacted vendors include cisco across adaptive security appliance, firepower threat defense. Scope summary: All Cisco ASA and FTD Software versions with Remote Access VPN (RAVPN) enabled (Clientless SSL VPN session establishment is limited to ASA Software Release 9.16 or earlier).
Q3. What temporary mitigations or workarounds exist for CVE-2023-20269 before patching?
[Mitigation] Apply official software updates from Cisco, or implement workarounds by redirecting default connection profile authentication to a loopback address and enforcing MFA. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-20269
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cisco)
View Category →Cisco ASA and FTD SSL VPN Remote Denial of Service Vulnerability (CVE-2026-20349)
[Affected Scope] Cisco Secure Firewall ASA and FTD Software with Remote Access SSL VPN service enabled
Cisco Secure Firewall Management Center (FMC) Authentication Bypass and Root RCE Vulnerability (CVE-2026-20079)
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software
Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Cisco Catalyst SD-WAN Peering Authentication Bypass Vulnerability (CVE-2026-20182)
[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.