CVE-2022-20952: cisco asyncos Improper Input Validation

Vulnerability summary

CVE-2022-20952 is a medium (CVSS 5.3) Improper Input Validation vulnerability in cisco asyncos. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.4% of scored vulnerabilities.

Timeline

1. 16-02-2023
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an unauthenticated, remote attacker to bypass a configured rule, thereby allowing traffic onto a network that should have been blocked. This vulnerability exists because malformed, encoded traffic is not properly detected. An attacker could exploit this vulnerability by connecting through an affected device to a malicious server and receiving malformed HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.