CVE-2022-20927

Vulnerability

A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software, identified as CVE-2022-20927, is due to improper memory management when an affected device initiates SSL/TLS connections. This can be exploited to cause an unexpected reload, resulting in a denial of service (DoS). The vulnerability affects multiple versions of Cisco ASA and FTD Software; refer to the Cisco advisory [1] for a complete list.

Exploitation

An attacker must be authenticated and have remote access to the network. The attacker needs to ensure that the affected device connects to an SSL/TLS server configured with specific encryption parameters. When the device establishes such a connection, the improper memory handling triggers a reload. No user interaction is required beyond the device initiating the connection.

Impact

Successful exploitation causes the affected device to unexpectedly reload, leading to a denial of service condition. No sensitive data is disclosed, and no code execution is achieved. The impact is limited to availability.

Mitigation

Cisco has released free software updates to address this vulnerability. Customers with service contracts should obtain the fixed software through their usual channels. For customers without service contracts, Cisco advises contacting their contracted maintenance providers. No workaround is available. Refer to the Cisco Security Advisory [1] for update details and affected version information.