Cisco ASA/FTD SNMP DoS via Authenticated Remote Exploit
CVE-2022-20924 Published on November 15, 2022
A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Vulnerability Analysis
CVE-2022-20924 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Improper Check or Handling of Exceptional Conditions
The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.
Products Associated with CVE-2022-20924
Want to know whenever a new CVE is published for Cisco products? stack.watch will email you.
Affected Versions
Cisco Adaptive Security Appliance (ASA) Software:- Version 9.14.1 is affected.
- Version 9.14.1.10 is affected.
- Version 9.14.1.6 is affected.
- Version 9.14.1.15 is affected.
- Version 9.14.1.19 is affected.
- Version 9.14.1.30 is affected.
- Version 9.14.2 is affected.
- Version 9.14.2.4 is affected.
- Version 9.14.2.8 is affected.
- Version 9.14.2.13 is affected.
- Version 9.14.2.15 is affected.
- Version 9.14.3 is affected.
- Version 9.14.3.1 is affected.
- Version 9.14.3.9 is affected.
- Version 9.14.3.11 is affected.
- Version 9.14.3.13 is affected.
- Version 9.14.3.18 is affected.
- Version 9.14.3.15 is affected.
- Version 9.14.4 is affected.
- Version 9.14.4.6 is affected.
- Version 9.14.4.7 is affected.
- Version 9.14.4.12 is affected.
- Version 9.15.1 is affected.
- Version 9.15.1.7 is affected.
- Version 9.15.1.10 is affected.
- Version 9.15.1.15 is affected.
- Version 9.15.1.16 is affected.
- Version 9.15.1.17 is affected.
- Version 9.15.1.1 is affected.
- Version 9.15.1.21 is affected.
- Version 9.16.1 is affected.
- Version 9.16.1.28 is affected.
- Version 9.16.2 is affected.
- Version 9.16.2.3 is affected.
- Version 9.16.2.7 is affected.
- Version 9.16.2.11 is affected.
- Version 9.16.2.13 is affected.
- Version 9.16.2.14 is affected.
- Version 9.16.3 is affected.
- Version 9.16.3.3 is affected.
- Version 9.16.3.14 is affected.
- Version 9.17.1 is affected.
- Version 9.17.1.7 is affected.
- Version 9.17.1.9 is affected.
- Version 9.17.1.10 is affected.
- Version 9.17.1.11 is affected.
- Version 9.17.1.13 is affected.
- Version 9.17.1.15 is affected.
- Version 9.18.1 is affected.
- Version 6.6.0 is affected.
- Version 6.6.0.1 is affected.
- Version 6.6.1 is affected.
- Version 6.6.3 is affected.
- Version 6.6.4 is affected.
- Version 6.6.5 is affected.
- Version 6.6.5.1 is affected.
- Version 6.6.5.2 is affected.
- Version 6.7.0 is affected.
- Version 6.7.0.1 is affected.
- Version 6.7.0.2 is affected.
- Version 6.7.0.3 is affected.
- Version 7.0.0 is affected.
- Version 7.0.0.1 is affected.
- Version 7.0.1 is affected.
- Version 7.0.1.1 is affected.
- Version 7.0.2 is affected.
- Version 7.0.2.1 is affected.
- Version 7.0.3 is affected.
- Version 7.1.0 is affected.
- Version 7.1.0.1 is affected.
- Version 7.1.0.2 is affected.
- Version 7.2.0 is affected.
- Version 7.2.0.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.