CVE-2020-3253
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. This is due to improper configuration of the support tunnel feature. An attacker could enable the support tunnel, set a key, and derive the tunnel password, allowing them to run any system command with root access.
Risk Assessment
An attacker with local access could gain full control over the device, potentially compromising the security of the entire network. This could enable malware installation or configuration changes.
Recommendation
Apply Cisco updates for FTD. Disable the support tunnel feature if not in use and restrict local access to devices.
Original NVD description (English source)
A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. The vulnerability is due to improper configuration of the support tunnel feature. An attacker could exploit this vulnerability by enabling the support tunnel, setting a key, and deriving the tunnel password. A successful exploit could allow the attacker to run any system command with root access on an affected device.