CVE-2023-20269: Cisco ASA Auth Bypass Vulnerability

CVE-2023-20269 Overview

CVE-2023-20269 is an authorization vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The flaw stems from improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An unauthenticated remote attacker can conduct brute-force attacks against valid username and password combinations by specifying a default connection profile or tunnel group. An authenticated attacker running Cisco ASA Software Release 9.16 or earlier can also establish a clientless SSL VPN session with an unauthorized user. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog, and ransomware operators including Akira and LockBit have leveraged it against Cisco VPN appliances.

Critical Impact
Unauthenticated remote attackers can identify valid VPN credentials at scale through brute-force attacks, enabling subsequent unauthorized VPN session establishment and lateral movement into corporate networks.

Affected Products

Cisco Adaptive Security Appliance (ASA) Software (versions 9.8.x through 9.19.x)
Cisco Firepower Threat Defense (FTD) Software (versions 6.2.3 through 7.4.0)
Cisco ASA Software Release 9.16 or earlier (additionally vulnerable to unauthorized clientless SSL VPN session establishment)

Discovery Timeline

2023-09-06 - CVE-2023-20269 published to NVD
2025-10-28 - Last updated in NVD database

Technical Details for CVE-2023-20269

Vulnerability Analysis

The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-863 (Incorrect Authorization). It affects the AAA enforcement layer that gates access to VPN tunnel groups on Cisco ASA and FTD appliances.

The core issue is that the remote access VPN feature shares AAA logic with HTTPS management and site-to-site VPN features, but the separation between these contexts is incomplete. An attacker who specifies a default connection profile or tunnel group during authentication can interact with AAA functions that should be scoped only to administrative or site-to-site contexts. This expands the attack surface for credential validation and, in older releases, for session establishment.

Valid credentials are still required to establish a remote access VPN session, including any configured multi-factor authentication (MFA) second factor. The vulnerability does not bypass authentication itself. It enables an attacker to identify valid credentials and, on ASA 9.16 and earlier, to establish a clientless SSL VPN session with an unauthorized user. Client-based remote access VPN tunnels cannot be established through the default connection profiles because these groups do not have an IP address pool configured.

Root Cause

The root cause is improper isolation of AAA between the remote access VPN feature and the HTTPS management and site-to-site VPN features. When an attacker references a default connection profile or tunnel group, the AAA subsystem processes authentication requests without enforcing the boundaries intended to keep these feature contexts separate.

Attack Vector

The vulnerability is exploitable remotely over the network without prior authentication. An attacker sends authentication requests to the VPN endpoint while specifying a default connection profile or tunnel group. Credentials are tested at speed, allowing automated enumeration of valid usernames and passwords against the appliance. Threat actors have used this technique to seed initial access for ransomware deployment, particularly when MFA is not enforced on the targeted accounts.

The vulnerability is described in prose only; no public proof-of-concept code is referenced in the advisory. See the Cisco Security Advisory for full technical details.

Detection Methods for CVE-2023-20269

Indicators of Compromise

High volumes of authentication attempts to the ASA or FTD VPN endpoint, particularly those referencing the DefaultRAGroup or DefaultWEBVPNGroup tunnel groups.
Authentication failures originating from a small set of source IP addresses against many usernames, or many source IPs targeting a small set of usernames (password spraying patterns).
Successful clientless SSL VPN session establishment from unusual geographic locations or hosting provider ranges.
Subsequent post-VPN activity consistent with Akira, LockBit, or similar ransomware affiliate tradecraft, including reconnaissance and lateral movement from VPN-assigned IP ranges.

Detection Strategies

Enable and forward ASA/FTD syslog at informational level or higher to a SIEM, focusing on message IDs %ASA-6-113015, %ASA-6-113005, %ASA-6-302013, and %ASA-6-722051 to correlate authentication failures with successful logins.
Build detection logic that alerts on a threshold of failed AAA authentications per source IP or per user within a short window, especially against default tunnel groups.
Correlate VPN login telemetry with endpoint and identity telemetry to identify accounts that authenticate successfully from anomalous locations following a burst of failed attempts.

Monitoring Recommendations

Monitor for new or unexpected sessions on default tunnel groups that should not normally accept user traffic.
Track baseline authentication volumes per tunnel group and alert on deviations.
Review RADIUS, TACACS+, and LDAP server logs that back the ASA/FTD AAA configuration for spikes in authentication queries from the appliance.

How to Mitigate CVE-2023-20269

Immediate Actions Required

Apply the fixed Cisco ASA and FTD software releases identified in the Cisco Security Advisory cisco-sa-asaftd-ravpn-auth-8LyfCkeC.
Enforce multi-factor authentication on all remote access VPN accounts so that credential discovery alone cannot result in a usable session.
Audit default connection profiles and tunnel groups (DefaultRAGroup, DefaultWEBVPNGroup) and restrict their use through AAA configuration.
Rotate credentials for any accounts that may have been targeted, particularly service and administrative accounts with VPN access.

Patch Information

Cisco has released software updates that address this vulnerability. Affected organizations should consult the Cisco Security Advisory for the specific fixed release matching their deployed ASA or FTD branch. CISA has also published this CVE in its Known Exploited Vulnerabilities catalog, establishing remediation deadlines for federal agencies.

Workarounds

Use Dynamic Access Policies (DAP) to terminate VPN sessions that attempt to use the DefaultRAGroup or DefaultWEBVPNGroup tunnel groups, as documented by Cisco.
Deny access with AAA by binding default group policies to a locked or invalid user database that cannot authenticate.
Use the vpn-simultaneous-logins setting in the default group policy to reduce session exposure.
Lock individual user accounts by assigning them to a group policy with vpn-simultaneous-logins set to 0, preventing VPN establishment while audits are completed.

bash

# Configuration example: deny access via the default WebVPN tunnel group
group-policy NoAccess internal
group-policy NoAccess attributes
 vpn-simultaneous-logins 0
 vpn-tunnel-protocol ssl-clientless
!
tunnel-group DefaultWEBVPNGroup general-attributes
 default-group-policy NoAccess
!
tunnel-group DefaultRAGroup general-attributes
 default-group-policy NoAccess