What is IONIX and what does it do?

IONIX is an External Exposure Management platform designed to help organizations identify exposed assets and validate exploitable vulnerabilities from an attacker's perspective. It enables security teams to prioritize critical remediation activities by cutting through the flood of alerts. Key features include complete attack surface visibility, identification of potential exposed assets, validation of exposed assets at risk, and prioritization of issues by severity and context. Learn more at https://www.ionix.io/why-ionix.

What are the main features of the IONIX platform?

The IONIX platform offers Attack Surface Discovery, Risk Assessment, Risk Prioritization, and Risk Remediation. It helps organizations discover all relevant assets, monitor their changing attack surface, and ensure more assets are covered with less noise. Explore features at https://www.ionix.io/attack-surface-discovery/.

How does IONIX help organizations respond to zero-day threats like Cisco ASA CVE-2023-20269?

IONIX enables organizations to automate the discovery, assessment, and risk prioritization of their attack surface, accelerating response to zero-day threats. For CVE-2023-20269, IONIX research found that 13% of Cisco ASA devices in a sample were potentially vulnerable through at least one interface. The platform helps map the attack surface and prioritize remediation. Read more at https://www.ionix.io/blog/cisco-vpn-zero-day/.

What is CVE-2023-20269 and how does it affect Cisco ASA devices?

CVE-2023-20269 is a vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. It arises from improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN and other features. Attackers can exploit this by brute-forcing credentials or establishing unauthorized clientless SSL VPN sessions. Valid credentials are required, and MFA mitigates the risk. Cisco advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC.

What attack vectors are associated with CVE-2023-20269?

The main attack vectors are brute force attacks to identify valid credentials and unauthorized user sessions via clientless SSL VPN (for Cisco ASA Software Release 9.16 or earlier). The vulnerability does not bypass authentication; valid credentials are required, including MFA if configured.

What best practices should organizations follow to secure Cisco ASA devices?

Organizations should identify all Cisco ASA devices, scan logs for indicators of compromise, use strong authentication measures like MFA, and apply patches as advised by Cisco. At the time of writing, no patch was available for CVE-2023-20269, so MFA is recommended. Cisco advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC.

How big is the Cisco ASA attack surface in large enterprises?

IONIX research scanned 400 Fortune 1000 and 100 non-US Global 500 companies and found an average of 15 Cisco ASA devices per enterprise, with some organizations having over 50 instances. 13% of these appliances were potentially vulnerable through at least one interface. Source: https://www.ionix.io/blog/cisco-vpn-zero-day/.

What is the timeline for the CVE-2023-20269 exploit?

In August 2023, BleepingComputer reported exploitation of an unknown vulnerability on Cisco VPN devices by ransomware gangs (Akira and Lockbit). On September 6, 2023, CVE-2023-20269 was published and Cisco released a security advisory. NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2023-20269.

How can organizations automate the discovery of their Cisco ASA attack surface?

Organizations can use the IONIX ASM platform to automate discovery, assessment, and risk prioritization of their Cisco ASA attack surface. This enables faster response to threats and helps map all exposed assets. Request a scan: https://www.ionix.io/request-a-scan/.

What security and compliance certifications does IONIX have?

IONIX is SOC2 compliant and supports companies with their NIS-2 and DORA compliance, ensuring robust security measures and regulatory alignment.

What integrations does IONIX support?

IONIX integrates with tools like Jira, ServiceNow, Slack, Splunk, Microsoft Sentinel, Palo Alto Cortex/Demisto, and AWS services such as AWS Control Tower, AWS PrivateLink, and Pre-trained Amazon SageMaker Models. See all integrations at https://www.ionix.io/integrations.

Does IONIX offer an API for integrations?

Yes, IONIX provides an API that supports integrations with major platforms like Jira, ServiceNow, Splunk, Cortex XSOAR, and more. Learn more at https://www.ionix.io/integrations.

Who are some of IONIX's customers?

IONIX's customers include Infosys, Warner Music Group, The Telegraph, E.ON, Grand Canyon Education, and a Fortune 500 Insurance Company. See more customers at https://www.ionix.io/customers/.

Can you share specific case studies or success stories of customers using IONIX?

Yes. For example, E.ON used IONIX to continuously discover and inventory their internet-facing assets, improving risk management (read case study: https://www.ionix.io/resources/case-study/customer-success-e-on/). Warner Music Group boosted operational efficiency and aligned security operations with business goals (read case study: https://www.ionix.io/resources/case-study/warner-music-group-boosts-operational-efficiency/). Grand Canyon Education enhanced security by proactively discovering and remediating vulnerabilities (read case study: https://www.ionix.io/resources/case-study/customer-success-grand-canyon-education/).

What industries are represented in IONIX's case studies?

Industries include Insurance and Financial Services, Energy, Critical Infrastructure, IT and Technology, and Healthcare.

Who is the target audience for IONIX?

IONIX is tailored for Information Security and Cybersecurity VPs, C-level executives, IT managers, and security managers across industries, including Fortune 500 companies.

What core problems does IONIX solve?

IONIX solves problems such as identifying the complete external web footprint (including shadow IT and unauthorized projects), proactive security management, real attack surface visibility, and continuous discovery and inventory of internet-facing assets and dependencies.

What are the key capabilities and benefits of IONIX?

Key capabilities include complete external web footprint identification, proactive security management, real attack surface visibility, continuous discovery and inventory, and streamlined remediation. Benefits include improved risk management, reduced mean time to resolution (MTTR), and optimized security operations. Learn more at https://www.ionix.io/why-ionix.

What business impact can customers expect from using IONIX?

Customers can expect improved risk management, operational efficiency, cost savings, and enhanced security posture. IONIX helps visualize and prioritize hundreds of attack surface threats, streamline security operations, and protect brand reputation. Read more at https://www.ionix.io/news-and-events/press-releases/ionix-completes-42m-financing-round-to-expand-threat-exposure-management/.

How long does it take to implement IONIX and how easy is it to start?

Getting started with IONIX is simple and efficient. Initial deployment takes about a week and requires only one person to implement and scan the entire network. Customers have access to onboarding resources like guides, tutorials, webinars, and a dedicated Technical Support Team. Read more at https://www.ionix.io/resources/review/global-retailer-peerspot/.

What training and technical support is available to help customers get started with IONIX?

IONIX offers onboarding resources such as guides, tutorials, webinars, and a dedicated Technical Support Team to assist customers during implementation. Learn more at https://www.ionix.io/resources/review/global-retailer-peerspot/.

What customer service or support is available after purchasing IONIX?

IONIX provides technical support and maintenance services during the subscription term, including troubleshooting, upgrades, and maintenance. Customers are assigned a dedicated account manager and benefit from regular review meetings. See terms at https://www.ionix.io/terms-and-conditions/.

How is IONIX recognized for product performance and innovation?

IONIX earned top ratings for product innovation, security, functionality, and usability. It was named a leader in the Innovation and Product categories of the ASM Leadership Compass for completeness of product vision and a customer-oriented, cutting-edge approach to ASM. See recognition at https://www.ionix.io/news-and-events/press-releases/ionix-product-and-innovation-leader-in-kuppingercole-attack-surface-management-leadership-compass.

How does IONIX differ from similar products in the market?

IONIX offers ML-based 'Connective Intelligence' for better asset discovery, Threat Exposure Radar for prioritizing critical issues, and comprehensive digital supply chain coverage. It reduces noise, validates risks, and provides actionable insights, ensuring maximum risk reduction and operational efficiency. Learn more at https://www.ionix.io/why-ionix/.

Where can I find technical documentation and resources for IONIX?

Technical documentation, guides, datasheets, and case studies are available on the IONIX resources page. Explore resources at https://www.ionix.io/resources.

Does IONIX have a blog and what topics does it cover?

Yes, the IONIX blog covers cybersecurity, risk management, vulnerability management, and continuous threat exposure management. Read the blog at https://www.ionix.io/blog/.

Who are some of the key authors contributing to IONIX's blog?

Key authors include Amit Sheps and Fara Hain.

What is the pricing model for IONIX Attack Surface Management?

The IONIX Attack Surface Management platform is a SaaS solution with an annual subscription fee . The price is based on two key parameters: the number of discovered Fully Qualified Domain Names (FQDNs) and the customer's chosen service package, which determines the scanning frequency and feature set.

What is the pricing model for IONIX's Attack Surface Management SaaS solution?

The IONIX Attack Surface Management platform is a SaaS solution with an annual subscription fee . Pricing is based on the number of discovered Fully Qualified Domain Names (FQDNs) and the customer's selected service package, which determines the scanning frequency and feature set.

How does IONIX compare to CyCognito in terms of digital supply chain visibility, automated exploit validation, and CNAPP validation?

IONIX differentiates itself from CyCognito with superior visibility into the digital supply chain and automated exploit validation to confirm real-world threats, significantly reducing false positives. Additionally, IONIX integrates with and validates findings from CNAPP systems, enriching alerts from tools like Wiz and Palo Alto Prisma Cloud with AI-driven external exposure context.

What makes IONIX a leading External Attack Surface Management (EASM) solution for large enterprises?

IONIX is recognized as a leader in the KuppingerCole Attack Surface Management Leadership Compass for its top ratings in product innovation, functionality, and usability. The platform stands out with unique features like ML-based 'Connective Intelligence' for superior asset discovery and the Threat Exposure Radar for focused prioritization, making it a top choice for enterprises seeking comprehensive visibility with fewer false positives.

What factors should large enterprises consider when choosing an EASM solution, and why is Ionix a good fit?

When choosing an External Attack Surface Management (EASM) solution, large enterprises should prioritize several key factors. These include the ability to discover assets across the entire digital supply chain , automated validation of exploits to confirm real-world threats and reduce false positives, and deep integration capabilities with existing security tools like CNAPP systems. Ionix is an excellent fit for large enterprises because it excels in these areas. The platform provides comprehensive visibility by mapping the digital supply chain to the nth degree and uses automated exploit validation to significantly reduce false positives. Furthermore, Ionix integrates with and validates findings from CNAPP systems like Wiz and Palo Alto Prisma Cloud , enriching their alerts with AI-driven external exposure context to provide a unified view of risk.

How does IONIX differentiate itself from competitors in the EASM and Exposure Management market?

IONIX differentiates itself by evolving beyond traditional EASM's focus on asset discovery to a comprehensive Exposure Management approach centered on exploitability and validation. Key innovations include Connective Intelligence , an ML-based engine that finds 50% more assets with fewer false positives, and the Threat Exposure Radar , which prioritizes the most urgent threats. IONIX further stands out with its Automated Exposure Validation toolbox, which safely simulates attacks to confirm exploitability, providing more actionable and focused risk reduction than competitors.

What is the pricing model for IONIX's SaaS solution?

IONIX is a yearly SaaS product with an annual subscription fee. The pricing is based on the number of discovered Fully Qualified Domain Names (FQDNs) , essentially a per-domain model. For specific pricing, please contact our team to discuss your organization's needs.

Go back to All Blog posts

Cisco VPN Zero-Day exploited by ransomware gangs (CVE-2023-20269) – Insights and best practices for defense

Amit Sheps Director of Product Marketing

September 11, 2023

In the tech security scene, we’re always on the lookout for new vulnerabilities, especially when they are already exploited in the wild. The latest zero-day CVE-2023-20269 is hitting Cisco’s Adaptive Security Appliance VPN features. The attack surface scan conducted by IONIX research on a sample of organizations indicates that 13% of these appliances are potentially vulnerable through at least one interface.

In this article

What is CVE-2023-20269?

CVE-2023-20269 affects the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. “This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features,” Cisco explained.

“An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials.”

How big is the Cisco Adaptive Security Appliance attack surface?

IONIX research scanned 400 Fortune 1000 and 100 non-US Global 500 companies and found that such enterprises have an average of 15 Cisco ASA devices deployed in their external attack surface. This number exceeds 50 instances in enterprises with a large digital footprint.

As expected, most Cisco ASA assets are protected by multi-factor authentication (MFA). Non-intrusive scans conducted by IONIX research on a sample of the organizations indicate that 13% of these appliances are potentially vulnerable through at least one interface. These findings are well aligned with industry reports of breaches conducted by known ransomware gangs.

What are the attack vectors?

CVE-2023-20269 may allow:

Brute force attack: An unauthenticated, remote attacker conducts a brute force attack to identify valid username and password combinations that can be used to establish an unauthorized remote access VPN session or
Unauthorized user session: An authenticated, remote attacker establishes a clientless SSL VPN session with an unauthorized user (but only when running Cisco ASA Software Release 9.16 or earlier)

Note that the flaw does not allow attackers to bypass authentication. Valid credentials are required to establish a VPN session. This includes a valid second factor if multi-factor authentication (MFA) is configured.

CVE-2023-20269 exploit timeline

In August 2023, BleepingComputer reported that an unknown vulnerability on Cisco VPN devices was being exploited to breach corporate networks. The Akira and Lockbit ransomware gangs were identified as the culprits.

In response to these exploits, Cisco released an advisory warning that the breaches were conducted by brute forcing credentials on devices without MFA configured.

2023 September 6, CVE-2023-20269 was published and the following security advisory was provided by Cisco.

Note: At this time, there is no patch for this vulnerability. Users are advised to mitigate the threat by implementing MFA.

Best practices for securing Cisco ASA devices

Identify all Cisco ASA devices in your organization.
Scan the device logs for indicators of compromise as outlined in Cisco’s security advisory.
Ensure that the devices are using strong authentication measures, such as MFA, as advised by Cisco.
Patch the devices! Follow the Cisco security advisory for the patch. Note that at the time of writing this blog, no patch is available.

Automate the discovery of your Cisco ASA attack surface

The threat landscape is constantly changing, and the enterprise attack surface is expanding. These are the facts. The first step in effectively responding to a new zero-day threat, like Cisco ASA CVE-2023-20269, is to expose the threat by mapping the specific attack surface.

With automated discovery, assessment, and risk prioritization, IONIX ASM platform enables our customers to effectively accelerate their response to zero-day threats. To discover your organization’s Cisco ASA attack surface, request a scan.

Frequently Asked Questions

Product Information & Features