Cisco ASA Incorrect Privilege Assignment (CVE-2022-20759)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506197);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/07");

  script_cve_id("CVE-2022-20759");

  script_name(english:"Cisco ASA Incorrect Privilege Assignment (CVE-2022-20759)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the web services interface for remote access VPN
features of Cisco Adaptive Security Appliance (ASA) Software and Cisco
Firepower Threat Defense (FTD) Software could allow an authenticated,
but unprivileged, remote attacker to elevate privileges to level 15.
This vulnerability is due to improper separation of authentication and
authorization scopes. An attacker could exploit this vulnerability by
sending crafted HTTPS messages to the web services interface of an
affected device. A successful exploit could allow the attacker to gain
privilege level 15 access to the web management interface of the
device. This includes privilege level 15 access to the device using
management tools like the Cisco Adaptive Security Device Manager
(ASDM) or the Cisco Security Manager (CSM). Note: With Cisco FTD
Software, the impact is lower than the CVSS score suggests because the
affected web management interface allows for read access only.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-mgmt-privesc-BMFMUvye
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1f748ef1");
  # https://github.com/orangecertcc/security-research/security/advisories/GHSA-gq88-gqmj-7v24
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8404de16");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-20759");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(266, 269);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/05/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/05/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9" :
        {"versionEndExcluding" : "9.12.4.38", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.13.0" :
        {"versionEndExcluding" : "9.14.4", "versionStartIncluding" : "9.13.0", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.15.0" :
        {"versionEndExcluding" : "9.15.1.21", "versionStartIncluding" : "9.15.0", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16.0" :
        {"versionEndExcluding" : "9.16.2.14", "versionStartIncluding" : "9.16.0", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.0" :
        {"versionEndExcluding" : "9.17.1.7", "versionStartIncluding" : "9.17.0", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);