CVE-2020-3125 — CRITICAL (9.8)

Vulnerability Description

A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to impersonate the Kerberos key distribution center (KDC) and bypass authentication on an affected device that is configured to perform Kerberos authentication for VPN or local device access. The vulnerability is due to insufficient identity verification of the KDC when a successful authentication response is received. An attacker could exploit this vulnerability by spoofing the KDC server response to the ASA device. This malicious response would not have been authenticated by the KDC. A successful attack could allow an attacker to bypass Kerberos authentication.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Cisco	Asa 5505 Firmware	9.10\(1.220\)
Cisco	Asa 5505	-
Cisco	Asa 5510 Firmware	9.10\(1.220\)
Cisco	Asa 5510	-
Cisco	Asa 5512-X Firmware	9.10\(1.220\)
Cisco	Asa 5512-X	-
Cisco	Asa 5515-X Firmware	9.10\(1.220\)
Cisco	Asa 5515-X	-
Cisco	Asa 5520 Firmware	9.10\(1.220\)
Cisco	Asa 5520	-
Cisco	Asa 5525-X Firmware	9.10\(1.220\)
Cisco	Asa 5525-X	-
Cisco	Asa 5540 Firmware	9.10\(1.220\)
Cisco	Asa 5540	-
Cisco	Asa 5545-X Firmware	9.10\(1.220\)
Cisco	Asa 5545-X	-
Cisco	Asa 5550 Firmware	9.10\(1.220\)
Cisco	Asa 5550	-
Cisco	Asa 5555-X Firmware	9.10\(1.220\)
Cisco	Asa 5555-X	-

Related Weaknesses (CWE)

CWE-287

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-asa-Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-asa-Vendor Advisory

FAQ

What is CVE-2020-3125?

CVE-2020-3125 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to impersonate the Kerberos key distribution ...

How severe is CVE-2020-3125?

CVE-2020-3125 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-3125?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Asa 5505 Firmware, Cisco Asa 5505, Cisco Asa 5510 Firmware, Cisco Asa 5510, Cisco Asa 5512-X Firmware.