Cisco Security Updates – 11 August 2022

The impacted products:

• Cisco ASA Software or FTD Software with vulnerable AnyConnect or WebVPN configuration
• ASA 5506-X with FirePOWER Services
• ASA 5506H-X with FirePOWER Services
• ASA 5506W-X with FirePOWER Services
• ASA 5508-X with FirePOWER Services
• ASA 5516-X with FirePOWER Services
• Firepower 1000 Series Next-Generation Firewall
• Firepower 2100 Series Security Appliances
• Firepower 4100 Series Security Appliances
• Firepower 9300 Series Security Appliances
• Secure Firewall 3100
• Cisco ASA Software with the Clientless SSL VPN feature enabled
• Cisco ASDM
• Cisco ASA Software

Sample of the addressed vulnerabilities:

1. Cisco Adaptive Security Device Manager and Adaptive Security Appliance Software code execution (CVE-2022-20829):
   • CVSS: 9.1
   • Attack Vector: Network
   • Attack Complexity: Low
   • Privileges Required: High
   • User Interaction: None
   • Consequences: Gain Access
     
     
2. Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software denial of service (CVE-2022-20715)
   • CVSS: 8.6
   • Attack Vector: Network
   • Attack Complexity: Low
   • Privileges Required: None
   • User Interaction: None
   • Consequences: Denial of Service
     
     
3. Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software information disclosure (CVE-2022-20866)
   • CVSS: 7.4
   • Attack Vector: Network
   • Attack Complexity: High
   • Privileges Required: None
   • User Interaction: None
   • Consequences: Obtain Information

It should be highlighted that the mentioned “CVE-2022-20866” security flaw is due to a weakness in handling RSA keys on ASA and FTD devices that affects Cisco products running vulnerable Cisco ASA (9.16.1 and later) or Cisco FTD (7.0.0 and later) therefore If successfully exploited, it can let unauthenticated attackers retrieve an RSA private key remotely, which they can use to decrypt the device traffic or impersonate Cisco ASA/FTD devices.

Cisco recommends administrators of Cisco ASA or FTD should remove malformed or susceptible RSA keys and possibly revoke any certificates associated with those RSA keys as the RSA private key may have been leaked to a malicious actor.