PT-2026-23015 · Cisco · Cisco Secure Firewall Threat Defense (Ftd)+1

Kyle Ossinger · Publicado 2026-03-04 · Atualizado 2026-03-04 · CVE-2026-20018

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software (affected versions not specified)

Description A flaw exists in the sftunnel functionality that may allow an authenticated, remote attacker with administrative privileges to write arbitrary files as root on the underlying operating system. This is caused by inadequate validation of the directory path during file synchronization. An attacker could exploit this by creating a directory path outside the expected file location, potentially enabling the creation or replacement of any file on the operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-27

Identificadores relacionados

CVE-2026-20018

Produtos afetados

Cisco Secure Firewall Management Center (Fmc)

Cisco Secure Firewall Threat Defense (Ftd)

Referências · 3

• https://twitter.com/CVEnew/status/2029272795906035862 · Publicação no Twitter
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdfmc-dir-trav-wERgjhWq · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-20018 · Nota de Segurança