CVE-2022-20773 Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability
An attacker can impersonate the appliance via MITM to steal admin credentials or modify configurations if SSH is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-20773?
CVE-2022-20773 is a high-severity vulnerability in Cisco Umbrella Insights Virtual Appliance, published on 21 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability by performing a man-in-the-middle attack on an SSH connection to the Umbrella VA. A successful exploit could allow the attacker to learn the administrator credentials, change configurations, or reload the VA. Note: SSH is not enabled by default on the Umbrella VA.
Which versions are affected by CVE-2022-20773?
It affects 1 product.
Products include Cisco Umbrella Virtual Appliance.
How do I fix CVE-2022-20773?
No fix has been published for CVE-2022-20773 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-20773 being exploited?
There is no known exploitation of CVE-2022-20773 in the wild and no public exploit code.
Other vulnerabilities in Cisco Umbrella Insights Virtual Appliance
Sources
Also known as GHSA-wmwq-58jv-2qj3.