CVE-2026-20008

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-20008
A vulnerability in a small subset of CLI commands that are used on Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to craft Lua code that could be used on the underlying operating system as root. This vulnerability exists because user-provided input is not properly sanitized. An attacker could exploit this vulnerability by crafting valid Lua code and submitting it as a malicious parameter for a CLI command. A successful exploit could allow the attacker to inject Lua code, which could lead to arbitrary code execution as the root user. To exploit this vulnerability, an attacker must have valid Administrator credentials.

6.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-luainject-VescqgmS Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*
History

16 Apr 2026, 20:13

Type Values Removed Values Added
First Time Cisco firepower Threat Defense Software
Cisco
Cisco adaptive Security Appliance Software
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-luainject-VescqgmS - () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-luainject-VescqgmS - Vendor Advisory
Summary
  • (es) Una vulnerabilidad en un pequeño subconjunto de comandos CLI que se utilizan en el Software Cisco Secure Firewall Adaptive Security Appliance (ASA) y el Software Cisco Secure Firewall Threat Defense (FTD) podría permitir a un atacante autenticado y local crear código Lua que podría utilizarse en el sistema operativo subyacente como root. Esta vulnerabilidad existe porque la entrada proporcionada por el usuario no se sanea correctamente. Un atacante podría explotar esta vulnerabilidad creando código Lua válido y enviándolo como un parámetro malicioso para un comando CLI. Un exploit exitoso podría permitir al atacante inyectar código Lua, lo que podría conducir a la ejecución de código arbitrario como usuario root. Para explotar esta vulnerabilidad, un atacante debe tener credenciales de Administrador válidas.
CPE cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*

04 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-04 18:16

Updated : 2026-04-16 20:13

NVD link : CVE-2026-20008

Mitre link : CVE-2026-20008

CVE.ORG link : CVE-2026-20008

JSON object : View

Products Affected

cisco

  • firepower_threat_defense_software
  • adaptive_security_appliance_software
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')