CVE-2022-20759

CVE-2022-20759 is a privilege escalation vulnerability in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software, specifically affecting their web services interface for remote access VPN features. An authenticated, but unprivileged, remote attacker can exploit this flaw by sending crafted HTTPS messages to gain privilege level 15 access to the device's web management interface. While rated High severity (CVSS 8.8) due to its network attack vector and high impact on confidentiality, integrity, and availability, the impact on FTD is lower as its web management interface is read-only. There is no evidence of active exploitation, public exploit code, or inclusion in CISA's KEV catalog, though it has garnered some community discussion.