The Record – Jonathan Greig
Cisco on Thursday released three advisories for vulnerabilities discovered by cybersecurity firm Rapid7 in its Adaptive Security Software (ASA) and ASA-X systems. More than one million Cisco ASA devices are deployed worldwide and are designed to support VPN, IPS, and many other features.
CVE-2022-20829 â carrying a CVSS score of 9.1 â relates to Ciscoâs ASDM, a graphical user interface for remote administration of appliances using ASA. According to Rapid7, a malicious ASDM package can be installed on a Cisco ASA, allowing for arbitrary code to be executed on any system connected to the ASA through ASDM.
Cisco said in the advisory that CVE-2022-20829 has been patched and that they have no evidence of exploitation, but Rapid7 disagreed in its report, claiming the bug has not been addressed.
The report also highlights CVE-2021-1585, a bug that Cisco disclosed without a patch in July 2021. The company eventually fixed the issue in a June 2022 update, but Rapid7 says it was able to show that the exploit still works against the latest update. Cisco said it has no evidence that the vulnerability has been exploited.
Cisco did fix CVE-2022-20828, a vulnerability that allows attackers to achieve root access on ASA-X with FirePOWER Services.
Link: https://therecord.media/cisco-releases-advisories-for-bug-affecting-more-than-1-million-security-devices/