FKIE_CVE-2026-20009

Vulnerability from fkie_nvd - Published: 2026-03-04 18:16 - Updated: 2026-03-05 19:39
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
A vulnerability in the implementation of the proprietary SSH stack with SSH key-based authentication in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to log in to a Cisco Secure Firewall ASA device and execute commands as a specific user. This vulnerability is due to insufficient validation of user input during the SSH authentication phase. An attacker could exploit this vulnerability by submitting crafted input during SSH authentication to an affected device. A successful exploit could allow the attacker to log in to the device as a specific user without the private SSH key of that user. To exploit this vulnerability, the attacker must possess a valid username and the associated public key. The private key is not required. Notes: Exploitation of this vulnerability does not provide the attacker with root access. The authentication, authorization, and accounting (AAA) configuration command auto-enable is not affected by this vulnerability.  
References
psirt@cisco.comhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-keybypass-cr5xPUSf
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the implementation of the proprietary SSH stack with SSH key-based authentication in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to log in to a Cisco Secure Firewall ASA device and execute commands as a specific user.\r\n\r\nThis vulnerability is due to insufficient validation of user input during the SSH authentication phase. An attacker could exploit this vulnerability by submitting crafted input during SSH authentication to an affected device. A successful exploit could allow the attacker to log in to the device as a specific user without the private SSH key of that user. To exploit this vulnerability, the attacker must possess a valid username and the associated public key. The private key is not required.\r\nNotes:\r\n\r\nExploitation of this vulnerability does not provide the attacker with root access.\r\nThe authentication, authorization, and accounting (AAA) configuration command auto-enable is not affected by this vulnerability.\u0026nbsp;\u0026nbsp;"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la implementaci\u00f3n de la pila SSH propietaria con autenticaci\u00f3n basada en clave SSH en el software Cisco Secure Firewall Adaptive Security Appliance (ASA) podr\u00eda permitir a un atacante remoto no autenticado iniciar sesi\u00f3n en un dispositivo Cisco Secure Firewall ASA y ejecutar comandos como un usuario espec\u00edfico.\n\nEsta vulnerabilidad se debe a una validaci\u00f3n insuficiente de la entrada del usuario durante la fase de autenticaci\u00f3n SSH. Un atacante podr\u00eda explotar esta vulnerabilidad al enviar una entrada manipulada durante la autenticaci\u00f3n SSH a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante iniciar sesi\u00f3n en el dispositivo como un usuario espec\u00edfico sin la clave SSH privada de ese usuario. Para explotar esta vulnerabilidad, el atacante debe poseer un nombre de usuario v\u00e1lido y la clave p\u00fablica asociada. La clave privada no es necesaria.\nNotas:\n\nLa explotaci\u00f3n de esta vulnerabilidad no proporciona al atacante acceso de root.\nEl comando de configuraci\u00f3n de autenticaci\u00f3n, autorizaci\u00f3n y contabilidad (AAA) auto-enable no se ve afectado por esta vulnerabilidad."
    }
  ],
  "id": "CVE-2026-20009",
  "lastModified": "2026-03-05T19:39:11.967",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "psirt@cisco.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-04T18:16:14.833",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-keybypass-cr5xPUSf"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-138"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.