CVE-2023-20269 — Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
CVE-2023-20269: Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
CISA Known Exploited Vulnerability (KEV)
| Vendor / project | Cisco |
| Product | Adaptive Security Appliance and Firepower Threat Defense |
| Date added | 2023-09-13 |
| Due date | 2023-10-04 |
| Ransomware campaign use | Known |
Description
Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.
Required action (CISA)
Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.
Notes
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC; https://nvd.nist.gov/vuln/detail/CVE-2023-20269
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-20269
- KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog