CVE · Exploited · On CISA KEV

CVE-2023-20269

Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

9.1: CVSS 3.1
1: story
SEP 13: added to KEV

Severity: 9.1 Critical · NVD score
Vendor: Cisco
Product: Adaptive Security Appliance and Firepower Threat Defense
Published: Sep 6, 2023
Added to KEV: Sep 13, 2023
KEV deadline: Oct 4, 2023
Ransomware use: Known
Weakness: CWE-288, CWE-863

Part of Akira SonicWall SSL VPN Attacks →

What it is

Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

SEP 29
IntrusionsAkira Ransomware Actors Target SonicWall SSLVPNThis aggressive approach aligns with Akira’s historical tactics of exploiting VPN infrastructure as an initial access vector.DENNIS FISHER · 2 MIN

Official references

5 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC Vendor advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC