CVE-2022-20928
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A vulnerability in the authentication and authorization flows for VPN connections in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to establish a connection as a different user. This is due to a flaw in authorization verifications during the VPN authentication flow. An attacker with valid credentials could send a crafted packet during authentication, gaining access with another user's privileges.
Risk Assessment
The risk is that an attacker can gain unauthorized network access with another user's privileges, potentially compromising data confidentiality and integrity.
Recommendation
Apply Cisco updates for ASA and FTD. Monitor VPN sessions for unusual activity and enforce strong multi-factor authentication.
Original NVD description (English source)
A vulnerability in the authentication and authorization flows for VPN connections in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to establish a connection as a different user. This vulnerability is due to a flaw in the authorization verifications during the VPN authentication flow. An attacker could exploit this vulnerability by sending a crafted packet during a VPN authentication. The attacker must have valid credentials to establish a VPN connection. A successful exploit could allow the attacker to establish a VPN connection with access privileges from a different user.