Lucene search

K
cve[email protected]CVE-2022-20742
HistoryMay 03, 2022 - 4:15 a.m.

CVE-2022-20742

2022-05-0304:15:09
CWE-325
web.nvd.nist.gov
84
2
cisco
asa
firepower
vpn
library
vulnerability
cve-2022-20742
ipsec
ikev2
gcm
cipher
remote attack
data modification
cryptanalysis

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

7.2 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

45.9%

A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel. This vulnerability is due to an improper implementation of Galois/Counter Mode (GCM) ciphers. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a sufficient number of encrypted messages across an affected IPsec IKEv2 VPN tunnel and then using cryptanalytic techniques to break the encryption. A successful exploit could allow the attacker to decrypt, read, modify, and re-encrypt data that is transmitted across an affected IPsec IKEv2 VPN tunnel.

Affected configurations

NVD
Node
ciscofirepower_threat_defenseRange<6.4.0.15
OR
ciscofirepower_threat_defenseRange6.5.06.6.5.2
OR
ciscofirepower_threat_defenseRange7.0.07.0.2
OR
ciscofirepower_threat_defenseMatch7.1.0
OR
ciscoadaptive_security_appliance_softwareRange<9.12.4.38
OR
ciscoadaptive_security_appliance_softwareRange9.13.09.14.4
OR
ciscoadaptive_security_appliance_softwareRange9.15.09.15.1.21
OR
ciscoadaptive_security_appliance_softwareRange9.16.09.16.2.14
OR
ciscoadaptive_security_appliance_softwareRange9.17.09.17.1.7

CNA Affected

[
  {
    "product": "Cisco Adaptive Security Appliance (ASA) Software ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Social References

More

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

7.2 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

45.9%

Related for CVE-2022-20742