CVE-2019-1709
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to perform a command injection attack. The issue is due to insufficient input validation. An attacker could exploit this by injecting commands into arguments for a specific command, allowing execution with root privileges.
Risk Assessment
The risk is that an attacker with local access can gain full control of the device, potentially compromising the entire network.
Recommendation
Restrict CLI access to trusted administrators only. Apply Cisco updates and monitor CLI activities.
Original NVD description (English source)
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting commands into arguments for a specific command. A successful exploit could allow the attacker to execute commands with root privileges.