CVE-2023-20123: 
Duo Authentication for Windows Logon vulnerability analysis and mitigation

A vulnerability (CVE-2023-20123) was discovered in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP. The vulnerability was disclosed on April 5, 2023, affecting systems with the offline access feature enabled. This security flaw exists because session credentials do not properly expire, potentially allowing unauthorized access to affected macOS or Windows devices (Cisco Advisory).

The vulnerability is classified as CWE-294 (Authentication Bypass by Capture-replay). It received a CVSS v3.1 base score of 6.3 MEDIUM (Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The vulnerability specifically affects the offline access feature, which is designed to allow secure local logons to macOS or Windows systems when they cannot contact the Duo cloud service (NVD, Cisco Advisory).

A successful exploitation of this vulnerability could allow an unauthenticated, physical attacker to bypass MFA protection and gain unauthorized access to the affected device by replaying previously used multifactor authentication codes (Cisco Advisory).

The vulnerability requires physical access to the target device. At the time of the advisory's publication, Cisco PSIRT was not aware of any public announcements or malicious use of this vulnerability (Cisco Advisory).

Cisco has released software updates to address this vulnerability. For Duo Two-Factor Authentication for macOS, the fix is available in version 2.0.1 and later. For Duo Authentication for Windows Logon and RDP, the fix is available in version 4.2.2 and later. No workarounds are available for this vulnerability (Cisco Advisory, Duo RDP Notes).