CVE-2014-8023: Cisco Adaptive Security Appliance (ASA) Software 9.2(.3) and earlier, when challenge-response authenticatio...

Security readout for executives and security teams

CVE-2014-8023 is an access-control bypass in Cisco ASA Software 9.2(3) and earlier when challenge-response authentication is used. An already authenticated remote user may influence tunnel-group selection and bypass intended resource restrictions. The business concern is unauthorized VPN/resource access, not unauthenticated takeover. Exposure is most likely on Cisco ASA deployments running 9.2(3) or earlier with challenge-response authentication and tunnel-group based access controls. Systems not using that authentication flow or not relying on tunnel-group restrictions may have lower exposure, but the provided sources do not define exact configuration boundaries. Prioritize remediation for ASA VPN environments where different tunnel groups enforce materially different access rights. Authenticated access is required, so urgency is below unauthenticated edge compromise, but the impact can be significant if VPN users can cross authorization boundaries. Mitigation focus: Identify Cisco ASA appliances running 9.2(3) or earlier.; Determine whether challenge-response authentication is enabled.; Review tunnel-group policies for sensitive resource-access separation..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.