Observable discrepancy in Cisco Systems, Inc products - CVE-2022-20866

Vulnerability identifier: #VU66391

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20866

CWE-ID: CWE-203

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a logic error when the RSA key is stored in memory on a hardware platform that performs hardware-based cryptography. A remote attacker can perform a Lenstra side-channel attack and retrieve the RSA private key.

ASA 5506-X with FirePOWER Services
ASA 5506H-X with FirePOWER Services
ASA 5506W-X with FirePOWER Services
ASA 5508-X with FirePOWER Services
ASA 5516-X with FirePOWER Services
Firepower 1000 Series Next-Generation Firewall
Firepower 2100 Series Security Appliances
Firepower 4100 Series Security Appliances
Firepower 9300 Series Security Appliances
Cisco Firewall Threat Defense (FTD)
Cisco Adaptive Security Appliance (ASA)
Secure Firewall 3100

Install updates from vendor's website.

Cisco Firewall Threat Defense (FTD) - addressed in versions Cisco_FTD_SSP_FP1K_Hotfix_P-7.1.0.2-2.sh.REL.tar, Cisco_FTD_SSP_FP2K_Hotfix_P-7.1.0.2-2.sh.REL.tar, Cisco_FTD_SSP_Hotfix_P-7.1.0.2-2.sh.REL.tar, Cisco_FTD_Hotfix_P-7.1.0.2-2.sh.REL.tar, Cisco_FTD_SSP_FP3K_Hotfix_Q-7.1.0.3-2.sh.REL.tar, 7.0.4, 7.2.0.1
Cisco Adaptive Security Appliance (ASA) - addressed in versions 9.16.3.19, 9.17.1.13, 9.18.2

• Exploit #8240 - CVE-2022-20866 (RSA Key Checker for CVE-2022-20866) (August 11, 2022)

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rsa-key-leak-Ms7UEfZz

• Observable discrepancy in Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software