Cisco ASA/FTD Observable Discrepancy (CVE-2022-20866)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505547);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/21");

  script_cve_id("CVE-2022-20866");

  script_name(english:"Cisco ASA/FTD Observable Discrepancy (CVE-2022-20866)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the handling of RSA keys on devices running Cisco
Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat
Defense (FTD) Software could allow an unauthenticated, remote attacker
to retrieve an RSA private key. This vulnerability is due to a logic
error when the RSA key is stored in memory on a hardware platform that
performs hardware-based cryptography. An attacker could exploit this
vulnerability by using a Lenstra side-channel attack against the
targeted device. A successful exploit could allow the attacker to
retrieve the RSA private key. The following conditions may be observed
on an affected device: This vulnerability will apply to approximately
5 percent of the RSA keys on a device that uses hardware-based
cryptography, which is expected to be a small number of keys. An
attacker must obtain a significant amount of ciphertext that was
encrypted using the targeted RSA key before the attack can be
successful.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a31f6d9e");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-20866");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(203);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/08/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:firepower_threat_defense");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.16_branch" :
        {"versionStartIncluding" : "9.16.0", "versionEndExcluding" : "9.16.3.19", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17_branch" :
        {"versionStartIncluding" : "9.17.0", "versionEndExcluding" : "9.17.1.13", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18_branch" :
        {"versionStartIncluding" : "9.18.0", "versionEndExcluding" : "9.18.2", "family" : "CiscoFirepower", "os" : "ASA"},
    "cpe:/o:cisco:firepower_threat_defense:7.0_branch" :
        {"versionStartIncluding" : "7.0.0", "versionEndExcluding" : "7.0.4", "family" : "CiscoFirepower", "os" : "FTD"},
    "cpe:/o:cisco:firepower_threat_defense:7.1_branch" :
        {"versionStartIncluding" : "7.1.0", "versionEndExcluding" : "7.2.0.1", "family" : "CiscoFirepower", "os" : "FTD"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);