Cisco ASA Argument Injection (CVE-2026-20016)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506144);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/07");

  script_cve_id("CVE-2026-20016");

  script_name(english:"Cisco ASA Argument Injection (CVE-2026-20016)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Cisco FXOS Software CLI feature for Cisco
Secure Firewall ASA Software and Secure FTD Software could allow an
authenticated, local attacker to execute arbitrary commands on the
underlying operating system with root-level privileges. To exploit
this vulnerability, the attacker must have valid administrative
credentials on an affected device. This vulnerability is due to
insufficient input validation of user-supplied command arguments. An
attacker could exploit this vulnerability by submitting crafted input
for specific CLI commands. A successful exploit could allow the
attacker to execute commands on the underlying operating system with
root-level privileges.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-cmd-inj-mTzGZexf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e0b6a6ba");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20016");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(88);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.12.1" :
        {"versionEndExcluding" : "9.16.4.85", "versionStartIncluding" : "9.12.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.17.1" :
        {"versionEndExcluding" : "9.18.4.66", "versionStartIncluding" : "9.17.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.19.1" :
        {"versionEndExcluding" : "9.20.4", "versionStartIncluding" : "9.19.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.22.1.1" :
        {"versionEndExcluding" : "9.22.2.4", "versionStartIncluding" : "9.22.1.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.23.1" :
        {"versionEndExcluding" : "9.23.1.7", "versionStartIncluding" : "9.23.1", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);