Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-20828

A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerability is due to improper handling of undefined command parameters. An attacker could exploit this vulnerability by using a crafted command on the CLI or by submitting a crafted HTTPS request to the web-based management interface of the Cisco ASA that is hosting the ASA FirePOWER module. Note: To exploit this vulnerability, the attacker must have administrative access to the Cisco ASA. A user who has administrative access to a particular Cisco ASA is also expected to have administrative access to the ASA FirePOWER module that is hosted by that Cisco ASA.

Published

2022-06-24T16:15:08.523

Last Modified

2024-11-21T06:43:38.367

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.0

Impact Score

10.0

Weaknesses
  • Type: Secondary
    CWE-236
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco asa_firepower < 6.2.3.19 Yes
Application cisco asa_firepower < 6.4.0.15 Yes
Application cisco asa_firepower < 6.6.7 Yes
Application cisco asa_firepower < 7.0.2.1 Yes
Hardware cisco firepower_1010 - No
Hardware cisco firepower_1120 - No
Hardware cisco firepower_1140 - No
Hardware cisco firepower_1150 - No
Hardware cisco firepower_2110 - No
Hardware cisco firepower_2120 - No
Hardware cisco firepower_2130 - No
Hardware cisco firepower_2140 - No
Hardware cisco firepower_4110 - No
Hardware cisco firepower_4112 - No
Hardware cisco firepower_4115 - No
Hardware cisco firepower_4120 - No
Hardware cisco firepower_4125 - No
Hardware cisco firepower_4140 - No
Hardware cisco firepower_4145 - No
Hardware cisco firepower_4150 - No
Hardware cisco firepower_9300 - No
Hardware cisco firepower_management_center - No
Hardware cisco firepower_management_center_virtual_appliance - No
References