CVE-2022-20826
Estado: ModificadaMedia (6.8)—
A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance (ASA) Software or Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated attacker with physical access to the device to bypass the secure boot functionality.
This vulnerability is due to a logic error in the boot process. An attacker could exploit this vulnerability by injecting malicious code into a specific memory location during the boot process of an affected device. A successful exploit could allow the attacker to execute persistent code at boot time and break the chain of trust.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 6.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.34%
- Percentil entre todas las CVEs puntuadas: 25
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-501
- NVD-CWE-Other
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-20826",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.4,
"attackVector": "PHYSICAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 0.5
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.8,
"attackVector": "PHYSICAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 0.9
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Adaptive Security Appliance (ASA) Software",
"versions": [
{
"status": "affected",
"version": "9.17.1"
},
{
"status": "affected",
"version": "9.17.1.9"
},
{
"status": "affected",
"version": "9.17.1.10"
},
{
"status": "affected",
"version": "9.17.1.13"
},
{
"status": "affected",
"version": "9.18.1"
},
{
"status": "affected",
"version": "9.18.1.3"
}
]
},
{
"vendor": "Cisco",
"product": "Cisco Firepower Threat Defense Software",
"versions": [
{
"status": "affected",
"version": "7.1.0"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.2.0.1"
}
]
}
]
}
],
"published": "2022-11-15T21:15:22.930",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fw3100-secure-boot-5M8mUh26",
"source": "psirt@cisco.com"
},
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fw3100-secure-boot-5M8mUh26",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-501"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance (ASA) Software or Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated attacker with physical access to the device to bypass the secure boot functionality.\r\n\r This vulnerability is due to a logic error in the boot process. An attacker could exploit this vulnerability by injecting malicious code into a specific memory location during the boot process of an affected device. A successful exploit could allow the attacker to execute persistent code at boot time and break the chain of trust."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la implementación de boot seguro de Cisco Secure Firewalls serie 3100 que ejecutan el Software Cisco Adaptive Security Appliance (ASA) o el Software Cisco Firepower Threat Defense (FTD) podría permitir que un atacante no autenticado con acceso físico al dispositivo omita la funcionalidad de boot seguro. Esta vulnerabilidad se debe a un error lógico en el proceso de boot. Un atacante podría aprovechar esta vulnerabilidad inyectando código malicioso en una ubicación de memoria específica durante el proceso de boot de un dispositivo afectado. Un exploit exitoso podría permitir al atacante ejecutar código persistente en el momento del boot y romper la cadena de confianza."
}
],
"lastModified": "2026-08-11T19:33:44.513",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27ACBA2A-87A7-4836-A474-AFD7D22F820D"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59306ADF-FAA6-4970-ADFB-C5D9A5AEF1AD"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "959107AC-E9EC-467C-901B-A3164E3762E9"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F39C535-5A41-47CE-A9CF-B360998D4BF9"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0BA16A6D-2747-4DAC-A30A-166F1FD906FA"
},
{
"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "289F9874-FC01-4809-9BDA-1AF583FB60B2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:secure_firewall_3105:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A5D9FDF8-13BF-425F-9802-1A334065D7C0"
},
{
"criteria": "cpe:2.3:h:cisco:secure_firewall_3110:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "87403E0F-659C-4C5B-863D-0274D2828A9A"
},
{
"criteria": "cpe:2.3:h:cisco:secure_firewall_3120:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "73D24C57-2311-48E9-879E-124472E98F6F"
},
{
"criteria": "cpe:2.3:h:cisco:secure_firewall_3130:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BE02D38A-5354-47E6-A46F-06D53F14F5A8"
},
{
"criteria": "cpe:2.3:h:cisco:secure_firewall_3140:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F191A423-DB18-4F3A-9D31-C3DD8F185C88"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.1.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2709EB00-CDE8-4C8D-B97E-19D091453A8C"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF35C6A1-BB05-49A3-8476-3249ABDFE54C"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2CA2F5B0-0106-4FF2-91BD-AEF3F064F69E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:secure_firewall_3105:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A5D9FDF8-13BF-425F-9802-1A334065D7C0"
},
{
"criteria": "cpe:2.3:h:cisco:secure_firewall_3110:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "87403E0F-659C-4C5B-863D-0274D2828A9A"
},
{
"criteria": "cpe:2.3:h:cisco:secure_firewall_3120:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "73D24C57-2311-48E9-879E-124472E98F6F"
},
{
"criteria": "cpe:2.3:h:cisco:secure_firewall_3130:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BE02D38A-5354-47E6-A46F-06D53F14F5A8"
},
{
"criteria": "cpe:2.3:h:cisco:secure_firewall_3140:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F191A423-DB18-4F3A-9D31-C3DD8F185C88"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}