CVE-2023-20269

What it actually does

The flaw is an authorization and AAA-separation weakness in Cisco ASA and Cisco FTD remote access VPN handling. An unauthenticated remote attacker can target default connection profiles/tunnel groups, such as default VPN groups, to perform brute-force or credential-stuffing attempts and identify valid username/password combinations. If the attacker has valid credentials, and any required MFA succeeds, they may establish an unauthorized remote access VPN session; on Cisco ASA Software 9.16 and earlier, the issue can also allow establishment of a clientless SSL VPN session under conditions that should not be authorized. The vulnerability does not bypass authentication by itself, but it weakens the boundary between VPN, HTTPS management, and site-to-site VPN AAA contexts, enabling unauthorized VPN access paths when credentials are obtained.

Why it matters to the business

Successful exploitation can give an external attacker a foothold through the VPN, which may lead to internal reconnaissance, data theft, lateral movement, and ransomware deployment. Because this vulnerability is listed in CISA KEV, has been exploited in the wild, and is associated with ransomware activity, exposed ASA or FTD remote access VPN services should be treated as high-priority remediation targets. Organizations relying on Cisco ASA or FTD for perimeter VPN access may face operational disruption, incident response costs, credential resets, and potential compromise of internal systems if unauthorized VPN sessions are established.

How an attack unfolds

An attacker first identifies an internet-facing Cisco ASA or FTD device with remote access VPN or HTTPS VPN services enabled. The attacker then submits authentication attempts while specifying a default connection profile or tunnel group, taking advantage of improper separation between AAA contexts. By observing authentication behavior, the attacker can conduct password spraying, brute force, or credential stuffing to discover valid username and password combinations. If MFA is absent, weak, or successfully satisfied, the attacker can authenticate and establish an unauthorized VPN session; on affected ASA 9.16 and earlier deployments, a clientless SSL VPN session may be possible. Once connected, the attacker can use the VPN foothold to enumerate internal resources, access exposed services, harvest additional credentials, move laterally, exfiltrate data, or stage ransomware. Active exploitation and ransomware association make historical VPN authentication review important, especially for repeated failures followed by successful logins against default tunnel groups.

How to fix it

Upgrade affected Cisco ASA Software and Cisco FTD Software to Cisco-recommended fixed releases for the specific hardware platform and release train. Because exact fixed versions were not provided in the input, consult Cisco’s official advisory and upgrade matrix for CVE-2023-20269 and apply the applicable maintenance release. Where immediate upgrade is not possible, apply Cisco-documented workarounds: remove or disable unused default connection profiles/tunnel groups where possible, restrict remote access VPN exposure to trusted source networks, enforce MFA for all VPN users, disable clientless SSL VPN if not required, and harden VPN authentication policies against spraying and brute force. Review all remote access VPN group policies, tunnel groups, AAA server mappings, and HTTPS management exposure to ensure that management, site-to-site VPN, and remote access VPN authentication and authorization are separated as intended. Rotate credentials for accounts that show suspicious VPN activity and invalidate active sessions after remediation.

How to confirm the fix worked

Confirm the ASA or FTD device is running a Cisco release that includes the fix for this vulnerability. Validate that remote access VPN, HTTPS management, and site-to-site VPN profiles use intended AAA settings and that default tunnel groups are not usable for unintended remote access. Attempt controlled authentication tests against default connection profiles to ensure unauthorized profiles cannot be used to enumerate accounts or establish sessions. Verify MFA enforcement for every remote access VPN user and confirm that clientless SSL VPN is disabled unless explicitly required and supported by a fixed release. Review VPN logs after remediation to ensure there are no successful logins through default tunnel groups and that failed authentication attempts are rate-limited, monitored, and alerted.

Typical attack path

1. Scan for internet-facing Cisco ASA or Cisco FTD SSL VPN/remote access VPN services.
2. Attempt authentication while specifying a default connection profile or tunnel group such as a default remote-access or webvpn group.
3. Perform password spraying, brute force, or credential stuffing to identify valid credentials.
4. Authenticate using valid credentials and satisfy MFA if MFA is enforced.
5. Establish an unauthorized remote access VPN session, or a clientless SSL VPN session on vulnerable ASA 9.16 or earlier systems.
6. Use VPN access to enumerate internal network resources and accessible services.
7. Perform lateral movement, data access, credential theft, exfiltration, or ransomware staging.

How to detect it

Review Cisco ASA and FTD syslog, VPN authentication logs, AAA/RADIUS/TACACS logs, MFA provider logs, identity provider logs, and NetFlow/firewall telemetry for signs of exploitation. Focus on repeated authentication failures against remote access VPN services, especially password-spray patterns involving many usernames from one source IP or one username from many source IPs. Look for successful VPN or clientless SSL VPN logins that occur shortly after repeated failures, from unusual geographies, autonomous systems, hosting providers, residential proxy networks, or outside normal user working hours. Pay particular attention to sessions associated with default tunnel groups or connection profiles such as DefaultWEBVPNGroup, DefaultRAGroup, or other default/unused profiles. On ASA 9.16 or earlier, investigate any unexpected clientless SSL VPN/WebVPN session. Correlate VPN session start times with internal reconnaissance, SMB/RDP/SSH connections, unusual DNS lookups, privilege escalation attempts, large file transfers, or endpoint alerts. Because this issue has been associated with ransomware activity, also search for post-VPN indicators such as mass authentication attempts to internal systems, abnormal administrative tool usage, backup deletion attempts, and suspicious file encryption activity.

• DefaultWEBVPNGroup
• DefaultRAGroup
• DefaultL2LGroup
• %ASA-6-113012
• %ASA-6-113015
• %ASA-6-113016
• AAA user authentication Successful
• AAA user authentication Rejected
• User authentication failed
• User authentication succeeded
• clientless SSL VPN
• WebVPN session
• AnyConnect session established
• SVC connection established
• tunnel-group DefaultWEBVPNGroup
• tunnel-group DefaultRAGroup
• Group <DefaultWEBVPNGroup>
• Group <DefaultRAGroup>
• /+CSCOE+/
• /+webvpn+/

What your security team should do

• Immediately identify all internet-facing Cisco ASA and Cisco FTD appliances with remote access VPN, WebVPN, or HTTPS VPN services enabled.
• Prioritize remediation because the vulnerability is in CISA KEV, has active exploitation, and is associated with ransomware activity; the CISA due date was 2023-10-04.
• Upgrade to Cisco-recommended fixed ASA or FTD releases for each appliance and release train.
• Apply Cisco workarounds where upgrades cannot be completed immediately, including disabling unused default tunnel groups and reducing VPN exposure.
• Enforce MFA for all VPN users and investigate any account that authenticated without MFA or from unusual locations.
• Search historical VPN logs for password spraying, brute-force attempts, successful logins through default tunnel groups, and clientless SSL VPN sessions on ASA 9.16 or earlier.
• Reset passwords and revoke sessions for users with suspicious VPN activity, especially where many failures preceded a successful login.
• Add SIEM detections for repeated failed VPN authentication attempts, successful authentication following password-spray patterns, and any use of default VPN tunnel groups.
• Review firewall and VPN access policies to limit what authenticated VPN users can reach internally.
• If suspicious VPN access is found, perform incident response for lateral movement, credential theft, data exfiltration, and ransomware staging.