A threat actor using a Lenstra side-channel attack against a vulnerable device could exploit the security bug to retrieve the RSA private key. Cisco’s advisory blames a logic error in how RSA keys are handled in memory on platforms that do hardware-based cryptography, and rates CVE-2022-20866 at CVSS 7.4. ASA 9.16.1 and later and FTD 7.0.0 and later are affected; ASA 9.16.3.19, 9.17.1.13 and 9.18.2 and FTD 7.0.4, 7.2.0.1 or a 7.1.0 hotfix fix it, and there is no workaround. Patching does not un-leak a key, so Cisco also wants affected RSA keys replaced and their certificates revoked.
