PT-2018-8838 · Cisco · Sourcefire+2

Published 2018-10-05 · Updated 2019-10-09 · CVE-2018-0453

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Firepower System Software (affected versions not specified)

Description A vulnerability exists in the Sourcefire tunnel control channel protocol, allowing an authenticated, local attacker with root privileges to execute specific CLI commands on the Cisco Firepower Management Center (FMC) or other Firepower sensors and devices controlled by the same FMC. The issue arises from insufficient checks for certain CLI commands executed via a Sourcefire tunnel connection. An attacker could exploit this by authenticating with root privileges to a Firepower sensor or Cisco FMC and sending specific CLI commands, potentially modifying device configurations or deleting files on the device running Cisco FMC Software or on any Firepower device managed by Cisco FMC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

CWE-264

Related Identifiers

CVE-2018-0453

Affected Products

Cisco Firepower Management Center

Cisco Firepower System

Sourcefire

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-0453 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0453 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-fp-cmd-injection · Vendor Advisory