PT-2021-7233 · Cisco · Cisco Firepower Management Center

Maxim Suslov · Published 2021-11-02 · Updated 2024-11-26 · CVE-2022-20743

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Firepower Management Center (FMC) Software (affected versions not specified)

Description A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This is due to improper validation of files uploaded to the web management interface. An attacker could exploit this by uploading a maliciously crafted file, allowing them to store malicious files on the device and potentially execute arbitrary code on the affected device with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2022-03948

CVE-2022-20743

Affected Products

Cisco Firepower Management Center

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-security-bypass-JhOd29Gg · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03948 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20743 · Security Note
• https://vuldb.com/ru/?id.198871 · Note
• https://cybersecurity-help.cz/vdb/SB2022042809 · Note