CVE-2022-20866

설명

A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve an RSA private key. This vulnerability is due to a logic error when the RSA key is stored in memory on a hardware platform that performs hardware-based cryptography. An attacker could exploit this vulnerability by using a Lenstra side-channel attack against the targeted device. A successful exploit could allow the attacker to retrieve the RSA private key. The following con...

영향 제품·버전

제품 Cisco Adaptive Security Appliance (ASA) Software, adaptive security appliance software, secure firewall threat defense

영향 버전 Cisco Adaptive Security Appliance (ASA) Software, adaptive security appliance software, secure firewall threat defense >= 9.16.0 < 9.16.3.19, >= 9.17.0 < 9.17.1.13, >= 9.18.0 < 9.18.2, >= 7.0.0 < 7.0.4, >= 7.1.0 < 7.2.0.1

수정 버전 Cisco Adaptive Security Appliance (ASA) Software, adaptive security appliance software, secure firewall threat defense 9.16.3.19, 9.17.1.13, 9.18.2, 7.0.4, 7.2.0.1

기술 정보

CVSS 벡터 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE CWE-203

EPSS 데이터 기준일 2026.08.13