Skip to content
fr Sign in
7.7 High

CVE-2022-20927 A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat…

Description

A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when a device initiates SSL/TLS connections. An attacker could exploit this vulnerability by ensuring that the device will connect to an SSL/TLS server that is using specific encryption parameters. A successful exploit could allow the attacker to cause the affected device to unexpectedly reload, resulting in a DoS condition.

Affected products and versions

Product Affected versions Fixed in
Cisco Adaptive Security Appliance (ASA) Software 9.15 9.15.1 → 9.15.1.21 No fix stated
Cisco Adaptive Security Appliance (ASA) Software 9.14 9.14.1 → 9.14.3.18 No fix stated
Cisco Firepower Threat Defense Software 6.7 6.7.0 → 6.7.0.3 No fix stated
Cisco Firepower Threat Defense Software 6.6 6.6.0 → 6.6.5.2 No fix stated
Cisco FirePOWER Services Software for ASA Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco Adaptive Security Appliance (ASA) Software

The 161 CVEs of Cisco Adaptive Security Appliance (ASA) Software →
CVE-2025-20363 A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure… 9.0 Critical CVE-2025-20254 A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security… 5.8 Medium CVE-2025-20263 A vulnerability in the web services interface of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and… 8.6 High CVE-2025-20253 A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure… 8.6 High
Track this CVE