CVE-2022-20742: cisco adaptive_security_appliance_software Missing Cryptographic Step

Vulnerability summary

CVE-2022-20742 is a high (CVSS 7.4) Missing Cryptographic Step vulnerability in cisco adaptive_security_appliance_software. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.4% of scored vulnerabilities.

Timeline

1. 03-05-2022
   PublishedVulnerability first disclosed.
2. 06-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel. This vulnerability is due to an improper implementation of Galois/Counter Mode (GCM) ciphers. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a sufficient number of encrypted messages across an affected IPsec IKEv2 VPN tunnel and then using cryptanalytic techniques to break the encryption. A successful exploit could allow the attacker to decrypt, read, modify, and re-encrypt data that is transmitted across an affected IPsec IKEv2 VPN tunnel.

• CWE-325Missing Cryptographic StepThe product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.