Researcher claim bypass Cloudflare Firewall using Cloudflare

Tuesday , October 3 2023

Cisco ASA Zero-Day Exploited in Akira Ransomware Attacks

Cisco recently detected a zero-day vulnerability in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. This vulnerability has been targeted by Akira ransomware attacks since August. The vulnerability, known as CVE-2023-20269, has a CVSS score of 5.0 and is of medium severity. It affects the remote access VPN feature of Cisco ASA and FTD. The vulnerability can be exploited remotely without authentication through brute force attacks.

ALSO READ:

Hacker group again threat attack Bangladesh 19 September: CIRT Alert

CISCO has published an advisory regarding the issue. CISCO said, the vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.

This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following:

Identify valid credentials that could then be used to establish an unauthorized remote access VPN session.
Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier).

Click here to read the advisory published by CISCO.

Source: Bleeping computer, CISCO

 

About infosecbulletin

Check Also

Bangladesh-India “CYBER MAITREE-2023” start tomorrow

Bangladesh-India is jointly going to celebrate “CYBER MAITREE-2023” from 02-04 October 2023 arranged by Enhancing …

Leave a Reply

Your email address will not be published. Required fields are marked *

Infosecbulletin


This will close in 15 seconds