QID 317201

Date Published: 2022-06-29

QID 317201: Cisco Adaptive Security Device Manager (ASDM) and Adaptive Security Appliance (ASA) Software Client-side Arbitrary Code Execution Vulnerability (cisco-sa-asa-asdm-sig-NPKvwDjm)

A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those images by Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker with administrative privileges to upload an ASDM image that contains malicious code to a device that is running Cisco ASA Software.
QID category kept in practice as not supported to Cisco ASDM-IDM

Affected Products
The device was running a Cisco ASA Software release earlier than Release 9.18.2. The device was configured with a Cisco ASDM release earlier than Release 7.18.1.150. The Cisco ASDM image was using a Cisco ASDM-IDM Launcher release earlier than Release 1.9(4). The device was configured for HTTPS management access.

QID Detection Logic (Unauthenticated):
The QID sends a get request to /admin/public/index.html and fetches version information of ASDM of Cisco ASA device and The check matches Cisco ASA OS version retrieved via Unix Auth using "version" command.

A successful exploit could allow the attacker to execute arbitrary code on the machine of the targeted user with the privileges of that user on that machine.

  • CVSS V3 rated as Critical - 9.1 severity.
  • CVSS V2 rated as High - 6.4 severity.
    • Solution

    Customers are advised to refer to cisco-sa-asa-asdm-sig-NPKvwDjm for more information.

    Vendor References

    CVEs related to QID 317201

    CVE-2022-20829 |
    Software Advisories
    Advisory ID Software Component Link
    cisco-sa-asa-asdm-sig-NPKvwDjm URL Logo tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-asdm-sig-NPKvwDjm
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].