How severe is CVE-2022-20730?

CVE-2022-20730 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2022-20730 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-20730?

CVE-2022-20730 affects Cisco Firepower Threat Defense. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-20730?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-20730 published?

CVE-2022-20730 was published on 2022-05-03 and last updated on 2026-06-17.

CVE-2022-20730

CVE-2022-20730 is a medium-severity vulnerability in Cisco Firepower Threat Defense with a CVSS 3.x base score of 4.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-241.

Key facts

Severity: Medium (CVSS 3.x base score 4.0)
CVSS v2: 5.0
EPSS exploit prediction: 1% (56th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-241
Affected product: Cisco Firepower Threat Defense
Published: 2022-05-03
Last modified: 2026-06-17

Description

A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the Security Intelligence DNS feed. This vulnerability is due to incorrect feed update processing. An attacker could exploit this vulnerability by sending traffic through an affected device that should be blocked by the affected device. A successful exploit could allow the attacker to bypass device controls and successfully send traffic to devices that are expected to be protected by the affected device.

Frequently asked questions

What is CVE-2022-20730?: A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the Security Intelligence DNS feed. This vulnerability is due to incorrect feed update processing. An attacker could exploit this vulnerability by sending traffic through an affected device that should be blocked by the affected device. A successful exploit could allow the attacker to bypass device controls and successfully send traffic to devices that are expected to be protected by the affected device.
How severe is CVE-2022-20730?: CVE-2022-20730 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2022-20730 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-20730?: CVE-2022-20730 affects Cisco Firepower Threat Defense. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-20730?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-20730 published?: CVE-2022-20730 was published on 2022-05-03 and last updated on 2026-06-17.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-sidns-bypass-3PzA5pO

Affected products (1)

cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*

More vulnerabilities in Cisco Firepower Threat Defense

CVE-2021-44228 — Critical (CVSS 10.0): Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in…
CVE-2018-0101 — Critical (CVSS 10.0): A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA)…
CVE-2025-20333 — Critical (CVSS 9.9): A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco…
CVE-2024-20412 — Critical (CVSS 9.3): A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series…
CVE-2020-3187 — Critical (CVSS 9.1): A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower…
CVE-2025-20363 — Critical (CVSS 9.0): A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure…

All CVEs affecting Cisco Firepower Threat Defense →

Other CWE-241 vulnerabilities

CVE-2021-40116 — High (CVSS 8.6): Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote…
CVE-2022-39064 — High (CVSS 8.1): An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay…
CVE-2025-63548 — High (CVSS 7.5): An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a packet…
CVE-2025-2268 — High (CVSS 7.5): The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted…
CVE-2022-3029 — High (CVSS 7.5): In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot…
CVE-2022-24668 — High (CVSS 7.5): A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or…

Browse all CWE-241 vulnerabilities →