PT-2021-4605 · Cisco · Cisco Ftd

Brandon Sakai

·

Published

2021-10-27

·

Updated

2024-11-18

·

CVE-2021-34752

CVSS v2.0

6.8

Medium

VectorAV:L/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (affected versions not specified)
Description A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands with root privileges on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute commands with root privileges on the underlying operating system.
Recommendations To resolve the issue, update to the latest version of Cisco Firepower Threat Defense as detailed in the advisory. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation. Avoid using the vulnerable CLI commands until the issue is resolved. At the moment, there is no information about specific versions that contain a fix for this vulnerability, so updating to the latest version is crucial.

Fix

Command Injection

RCE

Weakness Enumeration

CWE-77CWE-20

Related Identifiers

BDU:2021-05288
CVE-2021-34752

Affected Products

Cisco Ftd