SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20120

MEDIUM(5.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Risk Signal Score25/100 — MITTEL
  • CVSS 5.8 — Mittel
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls. This vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceNetworkEvents
| where ActionType == "Allowed"
| where DestinationIP in (ProtectedNetworkIPs)
| where InitiatingProcessCommandLine contains "object-group-search access-control" // Placeholder for FTD/ASA logs indicating OGS configuration
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, DestinationIP, RemoteIP, RemotePort, Protocol

Splunk SPL

sourcetype=cisco:asa OR sourcetype=cisco:ftd action=allowed dest_ip IN (ProtectedNetworkIPs) "object-group-search access-control" // Placeholder for FTD/ASA logs indicating OGS configuration
| table _time, host, action, dest_ip, src_ip, dest_port, protocol

Sigma

title: Cisco ASA FTD ACL Bypass Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects attempts to bypass ACLs on Cisco ASA/FTD devices with Object Group Search configured.
author: SecBoard
date: 2026/09/16
logsource:
  product: cisco
  service: firewall
detection:
  selection:
    action: 'allowed'
    dest_ip: 
      - '10.0.0.0/8' # Placeholder for protected network IPs
      - '172.16.0.0/12'
      - '192.168.0.0/16'
    keywords:
      - 'object-group-search access-control' # Placeholder for FTD/ASA logs indicating OGS configuration
  condition: selection
level: medium

Elastic ES|QL

from network where event.action == "allowed" and destination.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") and message : "object-group-search access-control" // Placeholder for FTD/ASA logs indicating OGS configuration
| project @timestamp, host.name, event.action, destination.ip, source.ip, destination.port, network.protocol

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen