CVE-2022-20928
A vulnerability in the authentication and authorization flows for VPN connections in Cisco Adaptive Security Appliance (ASA) Software and…
- Published
- Updated
- Reserved
- Assigned by
- cisco
Description
A vulnerability in the authentication and authorization flows for VPN connections in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to establish a connection as a different user. This vulnerability is due to a flaw in the authorization verifications during the VPN authentication flow. An attacker could exploit this vulnerability by sending a crafted packet during a VPN authentication. The attacker must have valid credentials to establish a VPN connection. A successful exploit could allow the attacker to establish a VPN connection with access privileges from a different user.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ciscoCNA (assigner) | 3.1 | Medium5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| NVDNVD · Modified | 3.1 | Medium5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.83% · top 42% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.
Weakness
Affected products
Cisco · Cisco Adaptive Security Appliance (ASA) Software
- affected 9.8.1
- affected 9.8.1.5
- affected 9.8.1.7
- affected 9.8.2
- affected 9.8.2.8
- affected 9.8.2.14
- affected 9.8.2.15
- affected 9.8.2.17
- affected 9.8.2.20
- affected 9.8.2.24
- affected 9.8.2.26
- affected 9.8.2.28
- affected 9.8.2.33
- affected 9.8.2.35
- affected 9.8.2.38
- affected 9.8.3.8
- affected 9.8.3.11
- affected 9.8.3.14
- affected 9.8.3.16
- affected 9.8.3.18
- affected 9.8.3.21
- affected 9.8.3
- affected 9.8.3.26
- affected 9.8.3.29
- affected 9.8.4
- affected 9.8.4.3
- affected 9.8.4.7
- affected 9.8.4.8
- affected 9.8.4.10
- affected 9.8.4.12
- affected 9.8.4.15
- affected 9.8.4.17
- affected 9.8.4.25
- affected 9.8.4.20
- affected 9.8.4.22
- affected 9.8.4.26
- affected 9.8.4.29
- affected 9.8.4.32
- affected 9.8.4.33
- affected 9.8.4.34
- and 74 more
Cisco · Cisco Firepower Threat Defense Software
- affected 6.2.3
- affected 6.2.3.1
- affected 6.2.3.2
- affected 6.2.3.3
- affected 6.2.3.4
- affected 6.2.3.5
- affected 6.2.3.6
- affected 6.2.3.7
- affected 6.2.3.8
- affected 6.2.3.10
- affected 6.2.3.11
- affected 6.2.3.9
- affected 6.2.3.12
- affected 6.2.3.13
- affected 6.2.3.14
- affected 6.2.3.15
- affected 6.2.3.16
- affected 6.2.3.17
- affected 6.2.3.18
- affected 6.6.0
- affected 6.6.0.1
- affected 6.6.1
- affected 6.6.3
- affected 6.6.4
- affected 6.6.5
- affected 6.6.5.1
- affected 6.6.5.2
- affected 6.4.0
- affected 6.4.0.1
- affected 6.4.0.3
- affected 6.4.0.2
- affected 6.4.0.4
- affected 6.4.0.5
- affected 6.4.0.6
- affected 6.4.0.7
- affected 6.4.0.8
- affected 6.4.0.9
- affected 6.4.0.10
- affected 6.4.0.11
- affected 6.4.0.12
- and 13 more
Cisco · Cisco FirePOWER Services Software for ASA
- affected N/A
What to do
Exploitation: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-20928)Record last updated .