CVE-2022-20828

🗓️ 24 Jun 2022 15:25:16Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 110 Views🌐 WEB

A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerability is due to improper handling of undefined command parameters

Reporter	Title	Published	Views	Family All 17
0day.today	Cisco ASA-X With FirePOWER Services Authenticated Command Injection Exploit	5 Sep 202200:00	–	zdt
ATTACKERKB	CVE-2022-20828	22 Jun 202223:00	–	attackerkb
Circl	CVE-2022-20828	24 Jun 202220:31	–	circl
Cisco	Cisco FirePOWER Software for ASA FirePOWER Module Command Injection Vulnerability	22 Jun 202216:00	–	cisco
CNNVD	Cisco Adaptive Security Appliances Software 安全漏洞	22 Jun 202200:00	–	cnnvd
Check Point Advisories	Cisco Firepower ASA Command Injection (CVE-2022-20828)	7 Nov 202200:00	–	checkpoint_advisories
Cvelist	CVE-2022-20828 Cisco FirePOWER Software for ASA FirePOWER Module Command Injection Vulnerability	24 Jun 202215:25	–	cvelist
Metasploit	Cisco ASA-X with FirePOWER Services Authenticated Command Injection	2 Sep 202219:49	–	metasploit
NVD	CVE-2022-20828	24 Jun 202216:15	–	nvd
Packet Storm	Cisco ASA-X With FirePOWER Services Authenticated Command Injection	5 Sep 202200:00	–	packetstorm

NVD

Node

cisco asa_firepowerRange<6.2.3.19

cisco asa_firepowerRange6.3.0–6.4.0.15

cisco asa_firepowerRange6.5.0–6.6.7

cisco asa_firepowerRange6.7.0–7.0.2.1

AND

cisco firepower_1010Match-

cisco firepower_1120Match-

cisco firepower_1140Match-

cisco firepower_1150Match-

cisco firepower_2110Match-

cisco firepower_2120Match-

cisco firepower_2130Match-

cisco firepower_2140Match-

cisco firepower_4110Match-

cisco firepower_4112Match-

cisco firepower_4115Match-

cisco firepower_4120Match-

cisco firepower_4125Match-

cisco firepower_4140Match-

cisco firepower_4145Match-

cisco firepower_4150Match-

cisco firepower_9300Match-

cisco firepower_management_centerMatch-

cisco firepower_management_center_virtual_applianceMatch-

[
  {
    "product": "Cisco FirePOWER Services Software for ASA",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/168256/Cisco-ASA-X-With-FirePOWER-Services-Authenticated-Command-Injection.html
rapid7	www.rapid7.com/blog/post/2022/08/11/rapid7-discovered-vulnerabilities-in-cisco-asa-asdm-and-firepower-services-software/
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asasfr-cmd-inject-PE4GfdG