PT-2020-2231 · Cisco · Cisco Asa

Dor Segal + 3 · Published 2020-05-05 · Updated 2023-08-16 · CVE-2020-3125

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified)

Description The issue is related to errors in the Kerberos protocol implementation, which could allow a remote attacker to impersonate the Kerberos key distribution center (KDC) and bypass authentication on an affected device configured to perform Kerberos authentication for VPN or local device access. This is due to insufficient identity verification of the KDC when a successful authentication response is received. An attacker could exploit this by spoofing the KDC server response to the ASA device, potentially allowing them to bypass Kerberos authentication and impact the confidentiality, integrity, and availability of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2020-02147

CVE-2020-3125

Affected Products

Cisco Asa

References · 8

• https://bdu.fstec.ru/vul/2020-02147 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3125 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-asa-kerberos-bypass-96Gghe2sS · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/653095 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3125 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-asa-kerberos-bypass-96Gghe2sS · Vendor Advisory
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-3125 · Note
• https://t.me/cybersecuritytechnologies/1089 · Telegram Post