Is CVE-2023-20269 exploited in the wild?

Yes. CVE-2023-20269 is known to be exploited in the wild, first recorded on 15 February 2024. Treat it as urgent.

How severe is CVE-2023-20269?

Critical severity, with a CVSS score of 7.5, published 15 February 2024.

Which products and versions are affected?

Cisco ASA multiple versions affected by CVE-2020-3259; Cisco Firepower Management Center multiple versions affected by CVE-2023-20269; Cisco IOS XE multiple versions affected by CVE-2023-27532; Multiple security systems affected by CVE-2024-40711, CVE-2024-40766.

Is there a fix for CVE-2023-20269?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2023-20269 attacked?

It is attacked over the network or with local access.

Am I affected by CVE-2023-20269?

Check whether you run Cisco Adaptive Security Appliance (ASA), Cisco ASA, Cisco Firepower Management Center or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-20269: SafePay ransomware campaign

CVE-2023-20269 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2024-02-15

SafePay is a ransomware group that has conducted widespread attacks since August 2024, targeting businesses and critical infrastructure across multiple continents. The group gains access through credential theft, phishing, and exploitation of known vulnerabilities in security systems, then encrypts victim data and demands ransom. Organizations should implement security best practices to reduce the risk and impact of these attacks.

Technologies: Cisco Adaptive Security Appliance (ASA), Cisco IOS XE, Cisco Firepower Threat Defense (FTD). Vendors: Cisco.

Quick answers

Is CVE-2023-20269 exploited in the wild?: Yes. CVE-2023-20269 is known to be exploited in the wild, first recorded on 15 February 2024. Treat it as urgent.
How severe is CVE-2023-20269?: Critical severity, with a CVSS score of 7.5, published 15 February 2024.
Which products and versions are affected?: Cisco ASA multiple versions affected by CVE-2020-3259; Cisco Firepower Management Center multiple versions affected by CVE-2023-20269; Cisco IOS XE multiple versions affected by CVE-2023-27532; Multiple security systems affected by CVE-2024-40711, CVE-2024-40766.
Is there a fix for CVE-2023-20269?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-20269 attacked?: It is attacked over the network or with local access.
Am I affected by CVE-2023-20269?: Check whether you run Cisco Adaptive Security Appliance (ASA), Cisco ASA, Cisco Firepower Management Center or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SafePay actors exploit multiple known CVEs (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766) as initial access vectors, combined with credential harvesting and phishing. Once inside a network, they escalate privileges, disable security controls, and deploy file encryption. The attack chain is multi-stage and relies on both credential compromise and unpatched vulnerabilities in security appliances.

Affected products

Cisco Cisco ASA multiple versions affected by CVE-2020-3259
Cisco Cisco Firepower Management Center multiple versions affected by CVE-2023-20269
Cisco Cisco IOS XE multiple versions affected by CVE-2023-27532
Multiple security systems affected by CVE-2024-40711, CVE-2024-40766

Identifiers

CVE-2023-20269
CVE-2020-3259
CVE-2023-27532
CVE-2024-40711
CVE-2024-40766

Timeline

2024-08: other: SafePay ransomware group became highly active
2026-10-20: advisory: CISA published #StopRansomware advisory on SafePay

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.