Vulnerability · Published Nov 10, 2022 · Assigned by cisco
CVE-2022-20927
High 7.7
In plain English
A high-severity buffer overflow in Cisco Adaptive Security Appliance (ASA) Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Official description
A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when a device initiates SSL/TLS connections. An attacker could exploit this vulnerability by ensuring that the device will connect to an SSL/TLS server that is using specific encryption parameters. A successful exploit could allow the attacker to cause the affected device to unexpectedly reload, resulting in a DoS condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Adaptive Security Appliance (ASA) Software | 9.14.19.14.1.109.14.1.159.14.1.199.14.1.309.14.29.14.2.49.14.2.8 |
| Cisco | Cisco Firepower Threat Defense Software | 6.6.06.6.0.16.6.16.6.36.6.46.6.56.6.5.16.6.5.2 |
| Cisco | Cisco FirePOWER Services Software for ASA | N/A |
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H