FKIE_CVE-2022-20826

Vulnerability from fkie_nvd - Published: 2022-11-15 21:15 - Updated: 2024-11-21 06:43
Severity ?
6.4 (Medium) - CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
6.8 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance (ASA) Software or Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated attacker with physical access to the device to bypass the secure boot functionality. This vulnerability is due to a logic error in the boot process. An attacker could exploit this vulnerability by injecting malicious code into a specific memory location during the boot process of an affected device. A successful exploit could allow the attacker to execute persistent code at boot time and break the chain of trust.
References
psirt@cisco.comhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fw3100-secure-boot-5M8mUh26
af854a3a-2127-422b-91ae-364da2661108https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fw3100-secure-boot-5M8mUh26
Impacted products
Vendor Product Version
cisco adaptive_security_appliance_software 9.17.1
cisco adaptive_security_appliance_software 9.17.1.9
cisco adaptive_security_appliance_software 9.17.1.10
cisco adaptive_security_appliance_software 9.17.1.13
cisco adaptive_security_appliance_software 9.18.1
cisco adaptive_security_appliance_software 9.18.1.3
cisco secure_firewall_3105 -
cisco secure_firewall_3110 -
cisco secure_firewall_3120 -
cisco secure_firewall_3130 -
cisco secure_firewall_3140 -
cisco firepower_threat_defense 7.1.0.0
cisco firepower_threat_defense 7.2.0.0
cisco firepower_threat_defense 7.2.0.1
cisco secure_firewall_3105 -
cisco secure_firewall_3110 -
cisco secure_firewall_3120 -
cisco secure_firewall_3130 -
cisco secure_firewall_3140 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "27ACBA2A-87A7-4836-A474-AFD7D22F820D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "59306ADF-FAA6-4970-ADFB-C5D9A5AEF1AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "959107AC-E9EC-467C-901B-A3164E3762E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F39C535-5A41-47CE-A9CF-B360998D4BF9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BA16A6D-2747-4DAC-A30A-166F1FD906FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "289F9874-FC01-4809-9BDA-1AF583FB60B2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:secure_firewall_3105:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5D9FDF8-13BF-425F-9802-1A334065D7C0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_firewall_3110:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "87403E0F-659C-4C5B-863D-0274D2828A9A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_firewall_3120:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "73D24C57-2311-48E9-879E-124472E98F6F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_firewall_3130:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE02D38A-5354-47E6-A46F-06D53F14F5A8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_firewall_3140:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F191A423-DB18-4F3A-9D31-C3DD8F185C88",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7533780-0DF9-41BE-8455-F60676785689",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:firepower_threat_defense:7.2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CAF8ACA8-BDDA-4008-8422-46737396F4CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:firepower_threat_defense:7.2.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FCD2D11D-FF08-44E4-BF67-D8DD1E701FCD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:secure_firewall_3105:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5D9FDF8-13BF-425F-9802-1A334065D7C0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_firewall_3110:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "87403E0F-659C-4C5B-863D-0274D2828A9A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_firewall_3120:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "73D24C57-2311-48E9-879E-124472E98F6F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_firewall_3130:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE02D38A-5354-47E6-A46F-06D53F14F5A8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:secure_firewall_3140:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F191A423-DB18-4F3A-9D31-C3DD8F185C88",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance (ASA) Software or Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated attacker with physical access to the device to bypass the secure boot functionality.\r\n\r This vulnerability is due to a logic error in the boot process. An attacker could exploit this vulnerability by injecting malicious code into a specific memory location during the boot process of an affected device. A successful exploit could allow the attacker to execute persistent code at boot time and break the chain of trust."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la implementaci\u00f3n de boot seguro de Cisco Secure Firewalls serie 3100 que ejecutan el Software Cisco Adaptive Security Appliance (ASA) o el Software Cisco Firepower Threat Defense (FTD) podr\u00eda permitir que un atacante no autenticado con acceso f\u00edsico al dispositivo omita la funcionalidad de boot seguro. Esta vulnerabilidad se debe a un error l\u00f3gico en el proceso de boot. Un atacante podr\u00eda aprovechar esta vulnerabilidad inyectando c\u00f3digo malicioso en una ubicaci\u00f3n de memoria espec\u00edfica durante el proceso de boot de un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante ejecutar c\u00f3digo persistente en el momento del boot y romper la cadena de confianza."
    }
  ],
  "id": "CVE-2022-20826",
  "lastModified": "2024-11-21T06:43:38.120",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 5.9,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-11-15T21:15:22.930",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fw3100-secure-boot-5M8mUh26"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fw3100-secure-boot-5M8mUh26"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-501"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.