CVE-2022-20742
CVE-2022-20742 is a high-severity vulnerability in Cisco Firepower Threat Defense with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-325.
Key facts
- Severity: High (CVSS 3.x base score 7.4)
- CVSS v2: 5.8
- EPSS exploit prediction: 0% (34th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-325
- Affected product: Cisco Firepower Threat Defense
- Published:
- Last modified:
Description
A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel. This vulnerability is due to an improper implementation of Galois/Counter Mode (GCM) ciphers. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a sufficient number of encrypted messages across an affected IPsec IKEv2 VPN tunnel and then using cryptanalytic techniques to break the encryption. A successful exploit could allow the attacker to decrypt, read, modify, and re-encrypt data that is transmitted across an affected IPsec IKEv2 VPN tunnel.
Frequently asked questions
- What is CVE-2022-20742?
- A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel. This vulnerability is due to an improper implementation of Galois/Counter Mode (GCM) ciphers. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a sufficient number of encrypted messages across an affected IPsec IKEv2 VPN tunnel and then using cryptanalytic techniques to break the encryption. A successful exploit could allow the attacker to decrypt, read, modify, and re-encrypt data that is transmitted across an affected IPsec IKEv2 VPN tunnel.
- How severe is CVE-2022-20742?
- CVE-2022-20742 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
- Is CVE-2022-20742 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-20742?
- CVE-2022-20742 primarily affects Cisco Firepower Threat Defense. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2022-20742?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2022-20742 published?
- CVE-2022-20742 was published on 2022-05-03 and last updated on 2026-06-17.
References
Affected products (3)
- cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
More vulnerabilities in Cisco Firepower Threat Defense
- CVE-2021-44228 — Critical (CVSS 10.0): Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in…
- CVE-2018-0101 — Critical (CVSS 10.0): A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA)…
- CVE-2025-20333 — Critical (CVSS 9.9): A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco…
- CVE-2024-20412 — Critical (CVSS 9.3): A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series…
- CVE-2020-3187 — Critical (CVSS 9.1): A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower…
- CVE-2025-20363 — Critical (CVSS 9.0): A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure…
All CVEs affecting Cisco Firepower Threat Defense →
Other CWE-325 vulnerabilities
- CVE-2026-4601 — High (CVSS 8.7): Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
- CVE-2025-30147 — High (CVSS 8.7): Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum…
- CVE-2026-45445 — High (CVSS 7.5): Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the…
- CVE-2026-41395 — High (CVSS 7.5): OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes…
- CVE-2026-22863 — High (CVSS 7.5): Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The…
- CVE-2025-60704 — High (CVSS 7.5): Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.