What is CVE-2022-20759?

CVE-2022-20759 is a high-severity vulnerability in Cisco Adaptive Security Appliance Software, classified under Incorrect Privilege Assignment. CVSS score: 8.8/10. Published 2022-05-03.

How severe is CVE-2022-20759?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2022-20759 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Privilege escalation in Cisco Adaptive Security Appliance Software

CVE-2022-20759

A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. This vulnerability is due to improper separation of authentication and authorization scopes. An attacker could exploit this vulnerability by sending crafted HTTPS messages to the web services interface of an affected device. A successful exploit could allow the attacker to gain privilege level 15 access to the web management interface of the device. This includes privilege level 15 access to the device using management tools like the Cisco Adaptive Security Device Manager (ASDM) or the Cisco Security Manager (CSM). Note: With Cisco FTD Software, the impact is lower than the CVSS score suggests because the affected web management interface allows for read access only.

Published 2022-05-03 · last modified 2026-08-11.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.284 (98.1th percentile), scored 2026-10-18.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.282 · newest: 0.284 · change: +0.002

Affected products

Cisco Adaptive Security Appliance Software
Cisco Adaptive Security Appliance (Asa) Software
Cisco Firepower Threat Defense — versions 7.1.0
Cisco Secure Firewall Threat Defense — versions 7.1.0

Weakness classification (CWE)

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-m… (vendor-advisory, Vendor Advisory)
github.com/orangecertcc/security-research/security/advisories/GHSA-gq88-gqmj-7v… (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2022-20759?: CVE-2022-20759 is a high-severity vulnerability in Cisco Adaptive Security Appliance Software, classified under Incorrect Privilege Assignment. CVSS score: 8.8/10. Published 2022-05-03.
How severe is CVE-2022-20759?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2022-20759 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.