Vulnerability · Published May 6, 2020 · Assigned by cisco

CVE-2020-3125Cisco Adaptive Security Appliance Software Kerberos Authentication Bypass Vulnerability

High 8.1

In plain English

A high-severity improper authentication in Cisco Adaptive Security Appliance (ASA) Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS 3.0)8.1High

Exploit odds (30 days)2.4%top 15.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to impersonate the Kerberos key distribution center (KDC) and bypass authentication on an affected device that is configured to perform Kerberos authentication for VPN or local device access. The vulnerability is due to insufficient identity verification of the KDC when a successful authentication response is received. An attacker could exploit this vulnerability by spoofing the KDC server response to the ASA device. This malicious response would not have been authenticated by the KDC. A successful attack could allow an attacker to bypass Kerberos authentication.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Adaptive Security Appliance (ASA) Software	n/a

Weakness: CWE-287 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

20200506 Cisco Adaptive Security Appliance Software Kerberos Authentication Bypass Vulnerability vendor-advisory, x_refsource_CISCO