onyx

onyx --cves cve-2022-20759

CVE-2022-20759

HIGHPOCCisco ASA
score
<0.1
cvss
8.8
epss
28.4%
published
2022-05-03
kev added
—
first seen

Cisco ASA and FTD Software contain a privilege escalation caused by improper separation of authentication and authorization scopes in the web services interface, letting authenticated but unprivileged attackers gain level 15 privileges via crafted HTTPS messages, exploit requires sending crafted HTTPS messages to the web services interface.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2022-05-03 — PublishedP2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoCXscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 28.2%2026-09-23: epss 28.2%2026-09-24: epss 28.2%2026-09-25: epss 28.2%2026-09-26: epss 28.2%2026-09-27: epss 28.2%2026-09-28: epss 28.2%2026-09-29: epss 28.2%2026-09-30: epss 28.2%2026-10-01: epss 28.2%2026-10-02: epss 28.2%2026-10-03: epss 28.2%2026-10-04: epss 28.2%2026-10-05: epss 28.2%2026-10-06: epss 28.2%2026-10-07: epss 28.4%2026-10-08: epss 28.4%2026-10-09: epss 28.4%2026-10-10: epss 28.4%2026-10-11: epss 28.4%2026-10-12: epss 28.4%2026-10-13: epss 28.4%2026-10-14: epss 28.4%2026-10-15: epss 28.4%2026-10-16: epss 28.4%2026-10-18: epss 28.4%2026-10-19: epss 28.4%2026-10-20: epss 28.4%2026-10-21: epss 28.4%28.4%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx
  3. Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-266 CWE-269

References 2