CVE-2020-3514
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. The issue is due to insufficient protections on a configuration file used at container startup. An attacker could modify this file, leading to root command execution and impacting other FTD instances or the host Cisco FXOS device.
Risk Assessment
An attacker with local access could gain full control over the host, potentially compromising other FTD instances and the FXOS system.
Recommendation
Apply Cisco updates for FTD. Restrict local access to devices to trusted administrators only.
Other vulnerabilities in Cisco Firepower Threat Defense Software
See all- CVE-2024-20412Critical
A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthenticated, local attacker to access an affected system using static credentials. The issue is due to the presence of static accounts with hard-coded passwords.
- CVE-2019-1978Medium
A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, FirePOWER Services Software for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to improper reassembly of traffic streams. An attacker could exploit this by sending crafted streams through an affected device, potentially delivering malicious requests to protected systems.
- CVE-2023-20070Medium
A vulnerability in the TLS 1.3 implementation of Cisco FTD Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This is due to a logic error in memory allocation handling during a TLS 1.3 session. An attacker could send a crafted TLS 1.3 message sequence to cause a reload, resulting in a DoS condition.
- CVE-2023-20063High
A vulnerability in the inter-device communication mechanisms between Cisco Firepower Threat Defense (FTD) Software and Cisco Firepower Management (FMC) Software could allow an authenticated, local attacker to execute arbitrary commands with root permissions on the underlying operating system of an affected device. This is due to insufficient validation of user-supplied input. An attacker could exploit this by accessing the expert mode and submitting specific commands, potentially executing code in the context of FMC or FTD.
- CVE-2023-20177Medium
A vulnerability in the SSL file policy implementation of Cisco FTD Software during SSL/TLS inspection with a URL Category could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This is due to a logic error when inspecting SSL/TLS connections with URL Category configured. An attacker could send a crafted SSL/TLS connection to trigger a reload, resulting in bypass or DoS.
- CVE-2021-1448High
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device running in multi-instance mode. This is due to insufficient validation of user-supplied command arguments. An attacker could exploit this by submitting crafted input, leading to root command execution.
- CVE-2021-1402High
A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a device reload, causing a denial of service (DoS). The issue is due to insufficient validation of SSL/TLS messages during software-based decryption. Exploitation involves sending a crafted SSL/TLS message through the device.
- CVE-2021-1256Medium
A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker to overwrite files on the file system using directory traversal techniques. This is due to insufficient validation of user input for the file path in a specific CLI command. A successful exploit could cause system instability if important system files are overwritten.
- CVE-2020-3577High
A vulnerability in the ingress packet processing path of Cisco FTD Software for interfaces configured as Inline Pair or in Passive mode could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS). The issue is due to insufficient validation when processing Ethernet frames. An attacker could exploit this by sending malicious Ethernet frames. Consequences may include filling the /ngfw partition, preventing login and boot, or causing a process crash leading to reload.
- CVE-2020-3571High
A vulnerability in the ICMP ingress packet processing of Cisco Firepower Threat Defense (FTD) Software for Firepower 4110 appliances could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to incomplete input validation upon receiving ICMP packets. Exploitation involves sending a high number of crafted ICMP or ICMPv6 packets.
Original NVD description (English source)
A vulnerability in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their Cisco FTD instance and execute commands with root privileges in the host namespace. The attacker must have valid credentials on the device.The vulnerability exists because a configuration file that is used at container startup has insufficient protections. An attacker could exploit this vulnerability by modifying a specific container configuration file on the underlying file system. A successful exploit could allow the attacker to execute commands with root privileges within the host namespace. This could allow the attacker to impact other running Cisco FTD instances or the host Cisco FXOS device.