Cisco ASA Trust Boundary Violation (CVE-2022-20826)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506137);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/07");

  script_cve_id("CVE-2022-20826");

  script_name(english:"Cisco ASA Trust Boundary Violation (CVE-2022-20826)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the secure boot implementation of Cisco Secure
Firewalls 3100 Series that are running Cisco Adaptive Security
Appliance (ASA) Software or Cisco Firepower Threat Defense (FTD)
Software could allow an unauthenticated attacker with physical access
to the device to bypass the secure boot functionality. This
vulnerability is due to a logic error in the boot process. An attacker
could exploit this vulnerability by injecting malicious code into a
specific memory location during the boot process of an affected
device. A successful exploit could allow the attacker to execute
persistent code at boot time and break the chain of trust.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fw3100-secure-boot-5M8mUh26
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8388a793");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-20826");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(501);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/11/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/11/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.13");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.18.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9.18.1.3");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1" :
        {"versionEndIncluding" : "9.17.1", "versionStartIncluding" : "9.17.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.9" :
        {"versionEndIncluding" : "9.17.1.9", "versionStartIncluding" : "9.17.1.9", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.10" :
        {"versionEndIncluding" : "9.17.1.10", "versionStartIncluding" : "9.17.1.10", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1.13" :
        {"versionEndIncluding" : "9.17.1.13", "versionStartIncluding" : "9.17.1.13", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18.1" :
        {"versionEndIncluding" : "9.18.1", "versionStartIncluding" : "9.18.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18.1.3" :
        {"versionEndIncluding" : "9.18.1.3", "versionStartIncluding" : "9.18.1.3", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);