cbcvebase.
CVE-2020-3125
published 2020-05-06

CVE-2020-3125: A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to…

PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.36%
81.9th percentile
A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to impersonate the Kerberos key distribution center (KDC) and bypass authentication on an affected device that is configured to perform Kerberos authentication for VPN or local device access. The vulnerability is due to insufficient identity verification of the KDC when a successful authentication response is received. An attacker could exploit this vulnerability by spoofing the KDC server response to the ASA device. This malicious response would not have been authenticated by the KDC. A successful attack could allow an attacker to bypass Kerberos authentication.

Affected

18 ranges
VendorProductVersion rangeFixed in
ciscoadaptive_security_appliance_software>= 9.10 < 9.10.1.379.10.1.37
ciscoadaptive_security_appliance_software>= 9.12 < 9.12.3.29.12.3.2
ciscoadaptive_security_appliance_software>= 9.13 < 9.13.1.79.13.1.7
ciscoadaptive_security_appliance_software>= 9.8 < 9.8.4.159.8.4.15
ciscoadaptive_security_appliance_software>= 9.9 < 9.9.2.669.9.2.66
ciscoasa_5505_firmware
ciscoasa_5510_firmware
ciscoasa_5512-x_firmware
ciscoasa_5515-x_firmware
ciscoasa_5520_firmware
ciscoasa_5525-x_firmware
ciscoasa_5540_firmware
ciscoasa_5545-x_firmware
ciscoasa_5550_firmware
ciscoasa_5555-x_firmware
ciscoasa_5580_firmware
ciscoasa_5585-x_firmware
ciscocisco_adaptive_security_appliance_software

Detection & IOCsextracted from sources · hover to see the quote

  • Detect unauthenticated Kerberos authentication bypass attempts against Cisco ASA by monitoring for successful Kerberos authentication responses that were not validated/authenticated by the KDC — specifically spoofed KDC server responses to the ASA device.
  • Focus detection on Cisco ASA devices configured for Kerberos authentication for VPN or local device access, as these are the affected attack surfaces.
  • ·Software upgrade alone is insufficient — configuration changes after the software upgrade are also required to fully remediate this vulnerability.
  • ·There are no workarounds available for this vulnerability; patching and reconfiguration are the only mitigations.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_cisco8.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.