CVE-2022-20828Asa Firepower Vulnerability
A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root…
Published Sep 8, 2022 · Updated Nov 1, 2024
Key Facts
Patch immediately- CVE-2022-20828 is a high-severity vulnerability (CVSS 7.2 v3.1) affecting Asa Firepower (Cisco), Cisco FirePOWER Services Software for ASA.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 49% probability of exploitation in the next 30 days.
- Fixed versions are available, including Asa Firepower 6.2.3.19.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
49%
Higher than 98.8% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
75/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
2
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
- advisoryhttps://cxsecurity.com/issue/WLB-2022090010
- advisoryhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-asdm-sig-NPKvwDjm
- advisoryhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-asdm-sig-NPKvwDjm?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Adaptive%20Security%20Device%20Manager%20and%20Adaptive%20Security%20Appliance%20Software%20Client-side%20Arbitrary%20Code%20Execution%20Vulnerability&vs_k=1
- advisory20220622 Cisco FirePOWER Software for ASA FirePOWER Module Command Injection Vulnerability
- advisoryhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asasfr-cmd-inject-PE4GfdG?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20FirePOWER%20Software%20for%20ASA%20FirePOWER%20Module%20Command%20Injection%20Vulnerability&vs_k=1
- advisoryhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-config-Ab3Da
Description
A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerability is due to improper handling of undefined command parameters. An attacker could exploit this vulnerability by using a crafted command on the CLI or by submitting a crafted HTTPS request to the web-based management interface of the Cisco ASA that is hosting the ASA FirePOWER module.
Note: To exploit this vulnerability, the attacker must have administrative access to the Cisco ASA. A user who has administrative access to a particular Cisco ASA is also expected to have administrative access to the ASA FirePOWER module that is hosted by that Cisco ASA.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Asa FirepowerCisco | See advisory | 6.2.3.19 |
| Cisco FirePOWER Services Software for ASA | >= n/a | n/a |
Patched Releases
Asa Firepower
6.2.3.19
Timeline
Publicly disclosed
Sep 8, 2022
Last updated
Nov 1, 2024
Weakness Type
- CWE-236 Improper Handling of Undefined Parameters
References
- advisorycxsecurity.com · WLB-2022090010
- advisorytools.cisco.com · cisco-sa-asa-asdm-sig-NPKvwDjm
- advisorytools.cisco.com · cisco-sa-asa-asdm-sig-NPKvwDjm
- advisory20220622 Cisco FirePOWER Software for ASA FirePOWER Module Command Injection Vulnerability
- advisorytools.cisco.com · cisco-sa-asasfr-cmd-inject-PE4GfdG
FAQ
Common Questions.
A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user.
Affected: Asa Firepower (Cisco); Cisco FirePOWER Services Software for ASA versions >= n/a. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Asa Firepower 6.2.3.19.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2022-20828 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo