CVE-2022-20759Firepower Threat Defense Vulnerability
A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15.
Published May 3, 2022 · Updated Aug 11, 2026
Key Facts
Patch in the next maintenance window- CVE-2022-20759 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Firepower Threat Defense (Cisco), Secure Firewall Threat Defense (Cisco), Adaptive Security Appliance Software (Cisco) and 1 more product.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 28% probability of exploitation in the next 30 days.
- Fixed versions are available, including Adaptive Security Appliance Software 9.12.4.38, Adaptive Security Appliance Software 9.14.4, Adaptive Security Appliance Software 9.15.1.21.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
28%
Higher than 98.1% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
49/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. This vulnerability is due to improper separation of authentication and authorization scopes. An attacker could exploit this vulnerability by sending crafted HTTPS messages to the web services interface of an affected device.
A successful exploit could allow the attacker to gain privilege level 15 access to the web management interface of the device. This includes privilege level 15 access to the device using management tools like the Cisco Adaptive Security Device Manager (ASDM) or the Cisco Security Manager (CSM). Note: With Cisco FTD Software, the impact is lower than the CVSS score suggests because the affected web management interface allows for read access only.
Affected Products
6 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Firepower Threat DefenseCisco | 7.1.0 | 6.4.0.15 |
| Secure Firewall Threat DefenseCisco | 7.1.0 | 6.4.0.15 |
| Adaptive Security Appliance SoftwareCisco | See advisory | 9.12.4.38 |
| Cisco Adaptive Security Appliance (ASA) Software | >= n/a | n/a |
Patched Releases
Adaptive Security Appliance Software
9.12.4.38, 9.14.4, 9.15.1.21, 9.16.2.14, 9.17.1.7
Firepower Threat Defense
6.4.0.15
Secure Firewall Threat Defense
6.4.0.15, 6.6.5.2, 7.0.2
Timeline
Publicly disclosed
May 3, 2022
Last updated
Aug 11, 2026
Weakness Type
- CWE-266 Incorrect Privilege Assignment
- CWE-269 Improper Privilege Management
FAQ
Common Questions.
A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15.
Affected: Firepower Threat Defense (Cisco) versions 7.1.0; Secure Firewall Threat Defense (Cisco) versions 7.1.0; Adaptive Security Appliance Software (Cisco), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Adaptive Security Appliance Software 9.12.4.38, Adaptive Security Appliance Software 9.14.4, Adaptive Security Appliance Software 9.15.1.21.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2022-20759 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo