Lucene search

K
cve[email protected]CVE-2022-20829
HistoryJun 24, 2022 - 4:15 p.m.

CVE-2022-20829

2022-06-2416:15:08
CWE-345
web.nvd.nist.gov
113
4
cisco
asdm
vulnerability
packaging
validation
asa software
authenticated attacker
administrative privileges
nvd

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.007 Low

EPSS

Percentile

80.7%

A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those images by Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker with administrative privileges to upload an ASDM image that contains malicious code to a device that is running Cisco ASA Software. This vulnerability is due to insufficient validation of the authenticity of an ASDM image during its installation on a device that is running Cisco ASA Software. An attacker could exploit this vulnerability by installing a crafted ASDM image on the device that is running Cisco ASA Software and then waiting for a targeted user to access that device using ASDM. A successful exploit could allow the attacker to execute arbitrary code on the machine of the targeted user with the privileges of that user on that machine. Notes: To successfully exploit this vulnerability, the attacker must have administrative privileges on the device that is running Cisco ASA Software. Potential targets are limited to users who manage the same device that is running Cisco ASA Software using ASDM. Cisco has released and will release software updates that address this vulnerability.

Affected configurations

NVD
Node
ciscoisa_3000_firmwareRange<9.18.2
AND
ciscoisa_3000Match-
Node
ciscoasa_5585-x_firmwareRange<9.18.2
AND
ciscoasa_5585-xMatch-
Node
ciscoasa_5512-x_firmwareRange<9.18.2
AND
ciscoasa_5512-xMatch-
Node
ciscoasa_5515-x_firmwareRange<9.18.2
AND
ciscoasa_5515-xMatch-
Node
ciscoadaptive_security_device_managerRange<7.18.1.150
AND
ciscofirepower_1010Match-
OR
ciscofirepower_1120Match-
OR
ciscofirepower_1140Match-
OR
ciscofirepower_1150Match-
OR
ciscofirepower_2110Match-
OR
ciscofirepower_2120Match-
OR
ciscofirepower_2130Match-
OR
ciscofirepower_2140Match-
OR
ciscofirepower_4110Match-
OR
ciscofirepower_4112Match-
OR
ciscofirepower_4115Match-
OR
ciscofirepower_4120Match-
OR
ciscofirepower_4125Match-
OR
ciscofirepower_4140Match-
OR
ciscofirepower_4145Match-
OR
ciscofirepower_9300Match-

CNA Affected

[
  {
    "product": "Cisco Adaptive Security Appliance (ASA) Software ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Social References

More

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.007 Low

EPSS

Percentile

80.7%

Related for CVE-2022-20829