CVE-2022-20829: Cisco ASA/ASDM unsigned image code execution
The short version: CVE-2022-20829 stems from insufficient validation of ASDM image authenticity by Cisco ASA software. An attacker with administrative privileges on the ASA can install a malicious ASDM image; when a management user later connects with ASDM, the malicious code runs on that user's machine. The admin-privilege requirement is what keeps this from being a top-tier flaw. Steady hands — patch on your normal cycle.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — needs admin privileges on the device first |
| CVSS v3.1 (NVD) | 7.2 — High · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.21% · 86.72nd percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed in the wild; public research and tooling exist |
| Vulnerability type | CWE-345 insufficient verification of data authenticity → code execution via a malicious ASDM image |
| Requires authenticated session? | Yes — administrative privileges on the ASA |
| Affected | Cisco ASDM before 7.18.1.150 with ASA software before 9.18.2 (see advisory for platform detail) |
| Fixed in | ASDM 7.18.1.150 · ASA 9.18.2 (and later) |
What you need to know
ASA software didn't sufficiently verify the authenticity of an ASDM image during installation. An attacker who already holds administrative access to the ASA can install a crafted ASDM image containing malicious code; the payload then executes on the machine of a management user who connects to that device with ASDM.
- It's post-authentication. The attacker needs administrative privileges on the ASA to plant the image — this is not a remote, unauthenticated hit.
- The eventual target is the management user's machine. Potential victims are limited to people who administer that same ASA via ASDM.
- The full fix updates both components. You need the patched ASA software and the patched ASDM image; Cisco itself rates the practical severity as medium because of the privilege requirement.
How serious we see it
Moderate. The 7.2 already accounts for the high-privilege prerequisite, and that prerequisite is the whole story: an attacker must first be an ASA administrator, at which point they have significant control regardless. What this adds is a way to pivot from device admin to code execution on other administrators' workstations — a real escalation and persistence concern, but not an external, unauthenticated exposure, and not in CISA's KEV catalog. Patch it as part of normal maintenance, and don't rank it with the pre-auth appliance RCEs. The reassuring part is that it's bounded and has a defined fix.
Recommendations
Straight from Cisco's advisory:
- Patch both sides. Update to ASDM 7.18.1.150 and ASA 9.18.2 or later.
- Guard ASA administrative access. Enforce strong, MFA-protected admin credentials and limit who can install ASDM images — this is the privilege the flaw depends on.
- Keep the management plane off the public internet. Restrict ASA/ASDM management to trusted networks.
- Confirm your exposure first. Verify your ASDM and ASA versions.
How BreachRisk sees it
BreachRisk discovers internet-facing Cisco ASDM interfaces in your external footprint, fingerprints the version, and flags version-based exposures like this one. We identify and flag the affected ASDM/ASA versions; because exploitation requires existing administrative access to the device, our external view focuses on surfacing exposed management interfaces so you can both patch and reduce their reachability.
The continuous outside-in view keeps your exposed management planes mapped, so a flaw like this is a tracked, prioritized item rather than a surprise.