Pierluigi Paganini September 08, 2023

A zero-day vulnerability (CVE-2023-20269) in Cisco ASA and FTD is actively exploited in ransomware attacks, the company warns.

Cisco warns that a zero-day vulnerability (CVE-2023-20269) in Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) is actively exploited by ransomware groups to gain initial access to corporate networks.

An unauthenticated, remote attacker can exploit the vulnerability to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.

“This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials.” reads the advisory published by the IT giant. “A successful exploit could allow the attacker to achieve one or both of the following:

• Identify valid credentials that could then be used to establish an unauthorized remote access VPN session.
• Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier).“

The company explained that the zero-day vulnerability was exploited by ransomware groups, such as the Akira ransomware gang, to target organizations.

At the end of August, Cisco revealed that it was aware of attacks conducted by Akira ransomware threat actors targeting Cisco ASA VPNs that are not configured for multi-factor authentication.

Cisco has been actively investigating the hacking campaign with the help of Rapid7. Rapid7 researchers have observed increased threat activity targeting Cisco ASA SSL VPN appliances dating back to at least March 2023.

“Rapid7 identified at least 11 customers who experienced Cisco ASA-related intrusions between March 30 and August 24, 2023.” reads report published by Rapid7.

Threat actors are conducting credential stuffing and brute-force attacks targeting Cisco ASA (Adaptive Security Appliance) SSL VPNs.

The Akira ransomware has been active since March 2023, the threat actors behind the malware claim to have already hacked multiple organizations in multiple industries, including education, finance, and real estate. Like other ransomware gangs, the group has developed a Linux encryptor to target VMware ESXi servers.

The group now is targeting Cisco VPN products to gain initial access to corporate networks.

Sophos researchers observed in May the threat actor using compromised Cisco VPN accounts to breach target networks.

Bleeping Computer reported the information shared by the incident responder as ‘Aura’ on Twitter. Aura confirmed that threat actors targeted organizations using CISCO VPN appliances without MFA enabled.

BleepingComputer also reported that SentinelOne is investigating the possibility that the Akira ransomware group is exploiting an unknown vulnerability in the Cisco VPN software. 

Cisco has yet to address CVE-2023-20269, waiting for a fix the company recommends:

• Use dynamic access policy (DAP) to terminate VPN tunnel establishment when the DefaultADMINGroup or DefaultL2LGroup connection profile/tunnel group is used.
• Deny Remote Access VPN Using the Default Group Policy (DfltGrpPolicy). When the DfltGrpPolicy is not expected to be used for remote access VPN policy assignment, administrators can prevent remote access VPN session establishment using the DefaultADMINGroup or DefaultL2LGroup connection profiles/tunnel groups by setting the vpn-simultaneous-logins option for the DfltGrpPolicy to zero.
• Restrict Users in the LOCAL User Database.
• Lock Users to a Specific Connection Profile/Tunnel Group Only
• Prevent Users from Establishing Remote Access VPN Sessions

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco ASA)