CVE-2022-20759 — Incorrect Privilege Assignment in Cisco Adaptive Security Appliance Software

CWE-266 — Incorrect Privilege AssignmentCWE-269 — Improper Privilege Management3 documents3 sources
Severity
8.8HIGHNVD
EPSS
13.4%
top 5.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Adaptive Security Appliance SoftwareCisco Firepower Threat DefenseCisco Adaptive Security Appliance Software
Timeline
PublishedMay 3

Description

A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. This vulnerability is due to improper separation of authentication and authorization scopes. An attacker could exploit this vulnerability by sending crafted HTTPS messages to the web services interface of an affected devic…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDcisco/firepower_threat_defense6.5.0 — 6.6.5.2+3

🔴Vulnerability Details

1
CVEList
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Privilege Escalation Vulnerability↗2022-05-03
▶

📋Vendor Advisories

1
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Privilege Escalation Vulnerability↗2022-04-27
▶
CVE-2022-20759 — Incorrect Privilege Assignment | cvebase