PT-2022-2321 · Cisco · Cisco Umbrella Virtual Appliance

Fraser Hess · Published 2022-04-20 · Updated 2022-05-04 · CVE-2022-20773

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Umbrella Virtual Appliance (VA) (affected versions not specified)

Description The issue is related to the key-based SSH authentication mechanism, which uses a static SSH host key, allowing a remote attacker to perform a man-in-the-middle attack on an SSH connection. This could enable the attacker to impersonate the VA, learn administrator credentials, change configurations, or reload the VA. It is noted that SSH is not enabled by default on the Umbrella VA.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

BDU:2022-02511

CVE-2022-20773

Affected Products

Cisco Umbrella Virtual Appliance

References · 7

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uva-static-key-6RQTRs4c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20773 · Security Note
• https://bdu.fstec.ru/vul/2022-02511 · Security Note
• https://t.me/true_secator/2872 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022042110 · Note
• https://securityaffairs.co/wordpress/130443/hacking/cisco-umbrella-default-ssh-key.html · Note