Incorrect authorization in Cisco Firewall Threat Defense (FTD) and Cisco Adaptive Security Appliance (ASA) - CVE-2022-20928

Vulnerability identifier: #VU69201

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20928

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to establish a connection as a different user.

The vulnerability exists due to a flaw in the authorization verifications during the VPN authentication flow. A remote attacker can send a specially crafted packet during a VPN authentication and establish a VPN connection with access privileges from a different user.

Cisco Firewall Threat Defense (FTD)
Cisco Adaptive Security Appliance (ASA)

Install updates from vendor's website.

Cisco Firewall Threat Defense (FTD) - addressed in versions 006.004(000.015), 006.006(007), 007.000(002), 007.002(000), 9.8.4.46, 009.008(004.046), 9.12.4.48, 9.12.4.50, 9.12.4.52, 9.12.4.54, 9.14.4.13, 9.14.4.14, 9.14.4.15, 9.14.4.17, 9.16.3, 9.16.3.19, 9.16.3.23, 9.16.4, 9.17.1.13, 9.17.1.15, 9.17.1.20, 009.018(001), 9.18.1, 9.18.2, 9.18.2.5, 009.019(000.099)
Cisco Adaptive Security Appliance (ASA) - addressed in versions 006.004(000.015), 006.006(007), 007.000(002), 007.002(000), 9.8.4.46, 009.008(004.046), 9.12.4.48, 9.12.4.50, 9.12.4.52, 9.12.4.54, 9.14.4.13, 9.14.4.14, 9.14.4.15, 9.14.4.17, 9.16.3, 9.16.3.19, 9.16.3.23, 9.16.4, 9.17.1.13, 9.17.1.15, 9.17.1.20, 009.018(001), 9.18.1, 9.18.2, 9.18.2.5, 009.019(000.099)

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-vp-authz-N2GckjN6

• Incorrect authorization in Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software