CVE-2022-20773: Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability
A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability by performing a man-in-the-middle attack on an SSH connection to the Umbrella VA. A successful exploit could allow the attacker to learn the administrator credentials, change configurations, or reload the VA. Note: SSH is not enabled by default on the Umbrella VA.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure SSH is disabled on the Umbrella VA if it is not required. Note: SSH is not enabled by default on the Umbrella VA and the VA contains a static SSH host key that could allow an attacker to impersonate the VA.
Cisco Umbrella Virtual Appliance SSH = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2022-20773?
CVE-2022-20773 has been classified with a high severity due to the potential for unauthenticated remote attackers to impersonate a Cisco Umbrella Virtual Appliance.
How do I fix CVE-2022-20773?
To mitigate CVE-2022-20773, users should update their Cisco Umbrella Virtual Appliance to a version above 3.3.2 where the static SSH host key issue has been addressed.
What systems are affected by CVE-2022-20773?
CVE-2022-20773 affects Cisco Umbrella Virtual Appliance versions up to 3.3.2.
What can an attacker do if they exploit CVE-2022-20773?
An attacker exploiting CVE-2022-20773 can impersonate the Cisco Umbrella Virtual Appliance, potentially gaining unauthorized access to sensitive data.
Is there a workaround for CVE-2022-20773?
Currently, there are no specific workarounds for CVE-2022-20773 other than updating to the latest version of the affected software.