Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-3125

A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to impersonate the Kerberos key distribution center (KDC) and bypass authentication on an affected device that is configured to perform Kerberos authentication for VPN or local device access. The vulnerability is due to insufficient identity verification of the KDC when a successful authentication response is received. An attacker could exploit this vulnerability by spoofing the KDC server response to the ASA device. This malicious response would not have been authenticated by the KDC. A successful attack could allow an attacker to bypass Kerberos authentication.

Published

2020-05-06T17:15:11.807

Last Modified

2024-11-21T05:30:22.623

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-287
  • Type: Primary
    CWE-287
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco asa_5505_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5505 - No
Operating System cisco asa_5510_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5510 - No
Operating System cisco asa_5512-x_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5512-x - No
Operating System cisco asa_5515-x_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5515-x - No
Operating System cisco asa_5520_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5520 - No
Operating System cisco asa_5525-x_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5525-x - No
Operating System cisco asa_5540_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5540 - No
Operating System cisco asa_5545-x_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5545-x - No
Operating System cisco asa_5550_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5550 - No
Operating System cisco asa_5555-x_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5555-x - No
Operating System cisco asa_5580_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5580 - No
Operating System cisco asa_5585-x_firmware 9.10\(1.220\) Yes
Hardware cisco asa_5585-x - No
Operating System cisco adaptive_security_appliance_software < 9.8.4.15 Yes
Operating System cisco adaptive_security_appliance_software < 9.9.2.66 Yes
Operating System cisco adaptive_security_appliance_software < 9.10.1.37 Yes
Operating System cisco adaptive_security_appliance_software < 9.12.3.2 Yes
Operating System cisco adaptive_security_appliance_software < 9.13.1.7 Yes
References