PT-2023-9587 · Cisco · Cisco Secure Firewall Management Center

Kentaro Kawane · Published 2023-11-08 · Updated 2025-08-06 · CVE-2024-20374

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Management Center (FMC) Software versions (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker with Administrator-level privileges to execute arbitrary commands on the underlying operating system. This issue is due to insufficient input validation of certain HTTP request parameters sent to the web-based management interface. An attacker could exploit this by authenticating to the interface and sending a crafted HTTP request to an affected device, potentially allowing the execution of commands as the root user.

Recommendations To resolve this issue, update the Cisco Secure Firewall Management Center (FMC) Software to a version that includes the fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Command Injection

Weakness Enumeration

CWE-269

CWE-77

Related Identifiers

BDU:2024-08567

CVE-2024-20374

Affected Products

Cisco Secure Firewall Management Center

References · 6

• https://bdu.fstec.ru/vul/2024-08567 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20374 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20374 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmd-inj-2HBkA97G · Vendor Advisory
• https://vuldb.com/?id.281622 · Note
• https://t.me/cveNotify/131091 · Telegram Post