CVE-2022-20828

Deeper analysis

A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER modules stems from improper handling of undefined command parameters. This flaw affects the ASA FirePOWER module hosted on Cisco ASA devices and enables execution of arbitrary commands on the underlying operating system as the root user. The issue is tracked under CVE-2022-20828 with a CVSS 3.1 score of 6.5.

An authenticated remote attacker who already possesses administrative access to the Cisco ASA can exploit the vulnerability by submitting a crafted command through the CLI or a crafted HTTPS request to the web-based management interface. Successful exploitation grants root-level command execution on the ASA FirePOWER module's operating system, affecting confidentiality and integrity but not availability.

The Cisco Security Advisory cisco-sa-asasfr-cmd-inject-PE4GfdG addresses the issue, and public analysis from Rapid7 along with proof-of-concept material on Packet Storm further document the command injection vector.

EPSS for this CVE rose from lower values to a peak of 0.8063 before receding to the current 0.5304, indicating a clear post-disclosure increase in exploitation interest that warrants renewed attention.