Cisco ASA/FTD Authentication Bypass Using an Alternate Path or Channel (CVE-2023-20269)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505550);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/20");

  script_cve_id("CVE-2023-20269");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2024/09/05");

  script_name(english:"Cisco ASA/FTD Authentication Bypass Using an Alternate Path or Channel (CVE-2023-20269)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the remote access VPN feature of Cisco Adaptive
Security Appliance (ASA) Software and Cisco Firepower Threat Defense
(FTD) Software could allow an unauthenticated, remote attacker to
conduct a brute force attack in an attempt to identify valid username
and password combinations or an authenticated, remote attacker to
establish a clientless SSL VPN session with an unauthorized user.
This vulnerability is due to improper separation of authentication,
authorization, and accounting (AAA) between the remote access VPN
feature and the HTTPS management and site-to-site VPN features. An
attacker could exploit this vulnerability by specifying a default
connection profile/tunnel group while conducting a brute force attack
or while establishing a clientless SSL VPN session using valid
credentials. A successful exploit could allow the attacker to achieve
one or both of the following: Identify valid credentials that could
then be used to establish an unauthorized remote access VPN session.
Establish a clientless SSL VPN session (only when running Cisco ASA
Software Release 9.16 or earlier).

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fca13e45");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-20269");

  script_cwe_id(288);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/09/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/09/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:firepower_threat_defense");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16_branch" :
        {"versionStartIncluding" : "9.16", "versionEndExcluding" : "9.16.4.54", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18_branch" :
        {"versionStartIncluding" : "9.18", "versionEndExcluding" : "9.18.4.5", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.19_branch" :
        {"versionStartIncluding" : "9.19", "versionEndExcluding" : "9.19.1.21", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.20_branch" :
        {"versionStartIncluding" : "9.20", "versionEndExcluding" : "9.20.1.1", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:firepower_threat_defense:7.0_branch" :
        {"versionStartIncluding" : "7.0", "versionEndExcluding" : "7.0.6.1", "family" : "CiscoFirepower", "os" : "FTD"},
    "cpe:/o:cisco:firepower_threat_defense:7.2_branch" :
        {"versionStartIncluding" : "7.2", "versionEndExcluding" : "7.2.5.1", "family" : "CiscoFirepower", "os" : "FTD"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);