CVE-2026-20008
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in a subset of CLI commands on Cisco Secure Firewall ASA and FTD Software allows an authenticated local attacker with administrator privileges to craft Lua code that could be used on the underlying operating system as root. This exists because user-provided input is not properly sanitized.
Risk Assessment
An attacker can inject malicious Lua code, potentially leading to full compromise of the device's operating system.
Recommendation
Install Cisco updates. Restrict administrative access to devices and monitor CLI command usage.
Other vulnerabilities in Cisco Secure Firewall
See all- CVE-2026-20023Medium
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated adjacent attacker to corrupt memory on an affected device, resulting in a DoS condition. This is due to memory corruption when parsing OSPF protocol packets.
- CVE-2026-20022Medium
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated adjacent attacker to cause an unexpected device reload, resulting in a DoS condition when OSPF canonicalization debug is enabled. This is due to insufficient input validation when processing OSPF LSU packets.
Original NVD description (English source)
A vulnerability in a small subset of CLI commands that are used on Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to craft Lua code that could be used on the underlying operating system as root. This vulnerability exists because user-provided input is not properly sanitized. An attacker could exploit this vulnerability by crafting valid Lua code and submitting it as a malicious parameter for a CLI command. A successful exploit could allow the attacker to inject Lua code, which could lead to arbitrary code execution as the root user. To exploit this vulnerability, an attacker must have valid Administrator credentials.