PT-2024-7464 · Cisco · Cisco Secure Firewall Management Center

CVE-2024-20482 · Published 2024-10-23 · Updated 2024-11-01

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Secure Firewall Management Center (FMC) Software (affected versions not specified)

Description: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to elevate privileges on an affected device. This is due to insufficient validation of role permissions in part of the web-based management interface. An attacker could exploit this vulnerability by performing a write operation on the affected part of the web-based management interface, potentially allowing them to modify certain parts of the configuration. To exploit this vulnerability, an attacker must have a valid account on the device that is configured with a custom read-only role.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2024-08844

CVE-2024-20482

Affected Products

Cisco Secure Firewall Management Center

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-priv-esc-CMQ4S6m7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08844 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20482 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20482 · Vendor Advisory
• https://t.me/cvenotify/100356 · Telegram Post
• https://t.me/cvedetector/8746 · Telegram Post
• https://twitter.com/UndercodeNews/status/1852494282818552305 · Twitter Post