PT-2022-6147 · Cisco · Cisco Firepower Management Center (Fmc)+2

Published 2022-11-09 · Updated 2024-11-26 · CVE-2022-20918

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module (affected versions not specified) Cisco Firepower Management Center (FMC) Software (affected versions not specified) Cisco Next-Generation Intrusion Prevention System (NGIPS) Software (affected versions not specified)

Description A vulnerability in the Simple Network Management Protocol (SNMP) access controls could allow an unauthenticated, remote attacker to perform an SNMP GET request using a default credential. This vulnerability is due to the presence of a default credential for SNMP version 1 (SNMPv1) and SNMP version 2 (SNMPv2). An attacker could exploit this vulnerability by sending an SNMPv1 or SNMPv2 GET request to an affected device. A successful exploit could allow the attacker to retrieve sensitive information from the device using the default credential. This attack will only be successful if SNMP is configured, and the attacker can only perform SNMP GET requests; write access using SNMP is not allowed.

Recommendations For Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module, consider disabling the default credential for SNMP version 1 (SNMPv1) and SNMP version 2 (SNMPv2) as a temporary workaround until a patch is available. For Cisco Firepower Management Center (FMC) Software, restrict access to the SNMP protocol to minimize the risk of exploitation. For Cisco Next-Generation Intrusion Prevention System (NGIPS) Software, avoid using the default credential for SNMP GET requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Authentication

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-287

CWE-269

Related Identifiers

BDU:2023-00173

CVE-2022-20918

Affected Products

Cisco Firepower Software For Adaptive Security Appliance (Asa) Firepower Module

Cisco Firepower Management Center (Fmc)

Cisco Next-Generation Intrusion Prevention System (Ngips)

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-20918 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20918 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcsfr-snmp-access-6gqgtJ4S · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00173 · Security Note
• https://t.me/cvenotify/37813 · Telegram Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcsfr-snmp-access-6gqgtJ4S · Note