CVE-2020-3125
📋 TL;DR
This vulnerability allows an unauthenticated remote attacker to impersonate a Kerberos Key Distribution Center (KDC) and bypass authentication on Cisco ASA devices configured for Kerberos authentication. Attackers can spoof KDC responses to gain unauthorized VPN or local device access without valid credentials. Organizations using Cisco ASA with Kerberos authentication for VPN or device access are affected.
💻 Affected Systems
- Cisco Adaptive Security Appliance (ASA) Software
📦 What is this software?
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
⚠️ Risk & Real-World Impact
Worst Case
Complete network compromise through unauthorized VPN access, lateral movement to internal systems, and potential data exfiltration.
Likely Case
Unauthorized VPN access leading to internal network reconnaissance and credential harvesting.
If Mitigated
Limited impact with proper network segmentation, multi-factor authentication, and monitoring in place.
🎯 Exploit Status
Exploitation requires network access to ASA device and knowledge of Kerberos authentication flow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.6.4.42, 9.8.4.20, 9.9.2.60, 9.10.1.24, 9.12.3.12, 9.13.1.10, 9.14.1.10 or later
Vendor Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-asa-kerberos-bypass-96Gghe2sS
Restart Required: Yes
Instructions:
1. Download appropriate ASA software version from Cisco.com. 2. Upload to ASA device. 3. Configure boot system to use new image. 4. Reload device. 5. Verify new version is running.
🔧 Temporary Workarounds
Disable Kerberos Authentication
allTemporarily disable Kerberos authentication and use alternative authentication methods
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
🧯 If You Can't Patch
- Implement network segmentation to isolate ASA devices
- Enable multi-factor authentication for VPN access
🔍 How to Verify
Check if Vulnerable:
Check ASA version with 'show version' and verify if Kerberos authentication is configuredCheck Version:
show version | include VersionVerify Fix Applied:
Verify ASA version is patched with 'show version' and test Kerberos authentication functionality📡 Detection & Monitoring
Log Indicators:
- Failed Kerberos authentication attempts followed by successful VPN connections
- Unusual source IP addresses establishing VPN connections
Network Indicators:
- Suspicious traffic to ASA Kerberos ports (88/tcp, 88/udp) from unexpected sources
SIEM Query:
source="asa" (event_id=113019 OR event_id=722051) AND (action="authenticated" OR action="established")