CVE-2026-20009

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-20009
A vulnerability in the implementation of the proprietary SSH stack with SSH key-based authentication in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to log in to a Cisco Secure Firewall ASA device and execute commands as a specific user. This vulnerability is due to insufficient validation of user input during the SSH authentication phase. An attacker could exploit this vulnerability by submitting crafted input during SSH authentication to an affected device. A successful exploit could allow the attacker to log in to the device as a specific user without the private SSH key of that user. To exploit this vulnerability, the attacker must possess a valid username and the associated public key. The private key is not required. Notes: Exploitation of this vulnerability does not provide the attacker with root access. The authentication, authorization, and accounting (AAA) configuration command auto-enable is not affected by this vulnerability.  

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-keybypass-cr5xPUSf Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
History

16 Apr 2026, 20:13

Type Values Removed Values Added
First Time Cisco
Cisco adaptive Security Appliance Software
CPE cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-keybypass-cr5xPUSf - () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-keybypass-cr5xPUSf - Vendor Advisory
Summary
  • (es) Una vulnerabilidad en la implementación de la pila SSH propietaria con autenticación basada en clave SSH en el software Cisco Secure Firewall Adaptive Security Appliance (ASA) podría permitir a un atacante remoto no autenticado iniciar sesión en un dispositivo Cisco Secure Firewall ASA y ejecutar comandos como un usuario específico. Esta vulnerabilidad se debe a una validación insuficiente de la entrada del usuario durante la fase de autenticación SSH. Un atacante podría explotar esta vulnerabilidad al enviar una entrada manipulada durante la autenticación SSH a un dispositivo afectado. Un exploit exitoso podría permitir al atacante iniciar sesión en el dispositivo como un usuario específico sin la clave SSH privada de ese usuario. Para explotar esta vulnerabilidad, el atacante debe poseer un nombre de usuario válido y la clave pública asociada. La clave privada no es necesaria. Notas: La explotación de esta vulnerabilidad no proporciona al atacante acceso de root. El comando de configuración de autenticación, autorización y contabilidad (AAA) auto-enable no se ve afectado por esta vulnerabilidad.

04 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-04 18:16

Updated : 2026-04-16 20:13

NVD link : CVE-2026-20009

Mitre link : CVE-2026-20009

CVE.ORG link : CVE-2026-20009

JSON object : View

Products Affected

cisco

  • adaptive_security_appliance_software
CWE
CWE-138

Improper Neutralization of Special Elements