Vulnerability CVE-2022-20949

Vulnerability Name:

CVE-2022-20949 (CCN-240212)

Assigned:

2021-11-02

Published:

2022-11-09

Updated:

2022-11-22

Summary:

A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This vulnerability exists because access to HTTPS endpoints is not properly restricted on an affected device. An attacker could exploit this vulnerability by sending specific messages to the affected HTTPS handler. A successful exploit could allow the attacker to perform configuration changes on the affected system, which should be configured and managed only through Cisco Firepower Management Center (FMC) Software.

CVSS v3 Severity:

4.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
4.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): High Availibility (A): None

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): High Availibility (A): High

CVSS v2 Severity:

8.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-Other

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2022-20949

Source: XF
Type: UNKNOWN
cisco-ftd-cve202220949-command-exec(240212)

Source: CCN
Type: Cisco Security Advisory cisco-sa-ftd-mgmt-privesc-7GqR2th
Cisco Firepower Threat Defense Software Privilege Escalation Vulnerability

Source: MISC
Type: Patch, Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-mgmt-privesc-7GqR2th

Vulnerable Configuration:

Configuration 1:

cpe:/a:cisco:firepower_threat_defense:6.2.1:*:*:*:*:*:*:*

OR cpe:/a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* (Version >= 6.1.0 and <= 6.1.0.7)

OR cpe:/a:cisco:firepower_threat_defense:7.1.0.0:*:*:*:*:*:*:*

OR cpe:/a:cisco:firepower_threat_defense:7.2.0.1:*:*:*:*:*:*:*

OR cpe:/a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* (Version >= 6.7.0 and <= 6.7.0.3)

OR cpe:/a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* (Version >= 6.5.0 and <= 6.5.0.5)

OR cpe:/a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* (Version >= 6.4.0 and <= 6.4.0.15)

OR cpe:/a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* (Version >= 6.3.0 and <= 6.3.0.5)

OR cpe:/a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* (Version >= 6.2.3 and <= 6.2.3.18)

OR cpe:/a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* (Version >= 6.2.0 and <= 6.2.0.6)

OR cpe:/a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* (Version >= 6.2.2 and <= 6.2.2.5)

OR cpe:/a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* (Version >= 6.6.0 and <= 6.6.5.2)

OR cpe:/a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* (Version >= 7.0.0 and <= 7.0.3)

OR cpe:/a:cisco:firepower_threat_defense:7.1.0.1:*:*:*:*:*:*:*

OR cpe:/a:cisco:firepower_threat_defense:7.1.0.2:*:*:*:*:*:*:*

OR cpe:/a:cisco:firepower_threat_defense:7.2.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK