CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2020-3125

CVSS 9.8v3.1pub. 2020-05-06upd. 2024-11-21

A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to impersonate the Kerberos key distribution center (KDC) and bypass authentication on an affected device that is configured to perform Kerberos authentication for VPN or local device access. The vulnerability is due to insufficient identity verification of the KDC when a successful authentication response is received. An attacker could exploit this vulnerability by spoofing the KDC server response to the ASA device. This malicious response would not have been authenticated by the KDC. A successful attack could allow an attacker to bypass Kerberos authentication.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cisco Adaptive Security Appliance Software

    OS
    Cisco
    9.8 – 9.8.4.15 (excl.)9.13 – 9.13.1.7 (excl.)9.12 – 9.12.3.2 (excl.)9.10 – 9.10.1.37 (excl.)9.9 – 9.9.2.66 (excl.)

  • Cisco Asa 5505

    HW
    Cisco
    all versions

  • Cisco Asa 5505 Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5510

    HW
    Cisco
    all versions

  • Cisco Asa 5510 Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5512 X

    HW
    Cisco
    all versions

  • Cisco Asa 5512 X Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5515 X

    HW
    Cisco
    all versions

  • Cisco Asa 5515 X Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5520

    HW
    Cisco
    all versions

  • Cisco Asa 5520 Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5525 X

    HW
    Cisco
    all versions

  • Cisco Asa 5525 X Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5540

    HW
    Cisco
    all versions

  • Cisco Asa 5540 Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5545 X

    HW
    Cisco
    all versions

  • Cisco Asa 5545 X Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5550

    HW
    Cisco
    all versions

  • Cisco Asa 5550 Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5555 X

    HW
    Cisco
    all versions

  • Cisco Asa 5555 X Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5580

    HW
    Cisco
    all versions

  • Cisco Asa 5580 Firmware

    OS
    Cisco
    9.10\(1.220\)

  • Cisco Asa 5585 X

    HW
    Cisco
    all versions

  • Cisco Asa 5585 X Firmware

    OS
    Cisco
    9.10\(1.220\)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Auth BypassVPN
CWE
References

Related vulnerabilities

CVE-2025-20333CRITICAL9.9⚠ KEVPL ✓same product

RCE jako root w Cisco ASA i FTD poprzez podatny serwer VPN web

CVE-2025-20363CRITICAL9.0PL ✓same product

RCE w web services Cisco ASA, FTD, IOS, IOS XE, IOS XR przez HTTP

CVE-2024-20329CRITICAL9.9PL ✓same product

RCE w podsystemie SSH Cisco ASA — wykonanie poleceń jako root

CVE-2022-20829CRITICAL9.1PL ✓same product

Cisco ASA – brak walidacji autentyczności obrazu ASDM umożliwia RCE

CVE-2020-3187CRITICAL9.1PL ✓same product

Path Traversal w Cisco ASA i FTD — nieautoryzowany dostęp do plików przez WebVPN/AnyConnect