CVE-2022-20952 Security feature bypass in Cisco Secure Web Appliance

Medium 5.3 Published 16 Feb 2023 Updated 3 Aug 2024

Remote attackers can bypass security rules on Cisco Secure Web Appliance by sending malformed encoded traffic, allowing blocked content to reach the network.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-20952?

CVE-2022-20952 is a medium-severity vulnerability in Cisco Asyncos, published on 16 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an unauthenticated, remote attacker to bypass a configured rule, thereby allowing traffic onto a network that should have been blocked. This vulnerability exists because malformed, encoded traffic is not properly detected. An attacker could exploit this vulnerability by connecting through an affected device to a malicious server and receiving malformed HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.

Weakness: CWE-20

Which versions are affected by CVE-2022-20952?

It affects 1 product.

Products include Cisco Asyncos.

How do I fix CVE-2022-20952?

No fix has been published for CVE-2022-20952 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-20952 being exploited?

There is no known exploitation of CVE-2022-20952 in the wild and no public exploit code.

All Cisco Asyncos vulnerabilities

Sources

Also known as GHSA-36pr-655q-f5wg.