ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2023-20269

Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

Published Aug 29, 2023 · catalog updated Aug 11, 2026 · Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)

Patch now

CVE-2023-20269 is in the CISA known-exploited catalog, due Oct 4, 2023. Confirm Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity
Critical9.1
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
25.45%
Remediation
Remediation guidance
Affected products
cpe cisco/adaptive security appliance software · cpe cisco/secure firewall threat defense · vendor Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · vendor Cisco Adaptive Security Appliance and Firepower Threat Defense

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe cisco/adaptive security appliance software9.8.1
  • cpe cisco/adaptive security appliance software9.8.1.5
  • cpe cisco/adaptive security appliance software9.8.1.7
  • cpe cisco/adaptive security appliance software9.8.2
  • cpe cisco/adaptive security appliance software9.8.2.14
  • cpe cisco/adaptive security appliance software9.8.2.15
  • cpe cisco/adaptive security appliance software9.8.2.17
  • cpe cisco/adaptive security appliance software9.8.2.8
  • cpe cisco/secure firewall threat defense6.2.3
  • vendor Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)version unspecified
  • vendor Cisco Adaptive Security Appliance and Firepower Threat Defenseversion unspecified

How to fix CVE-2023-20269

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2023-20269 is in the CISA known-exploited catalog, due Oct 4, 2023. Confirm Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with cisco/adaptive security appliance software 9.8.1; cisco/adaptive security appliance software 9.8.1.5; cisco/adaptive security appliance software 9.8.1.7; cisco/adaptive security appliance software 9.8.2. Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.

What should an analyst verify?

CWE-288; CWE-863: Incorrect Authorization. EPSS 25.45%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Cisco security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 6, 2023 · Catalog

    Detected

    A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized us

  2. Sep 13, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.

  3. Oct 4, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.

  4. Aug 11, 2026 · Catalog

    Updated

    A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized us

Sources

  • CISA KEVConfirmed exploitationCVE-2023-20269

    Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2023-20269

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2023-20269

    30-day exploitation probability 25.5%

    first.org
  • NIST NVDVulnerability recordCVE-2023-20269

    A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and pass

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2023-20269

    Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clien

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.