CVE-2020-3549
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A vulnerability in the sftunnel functionality of Cisco Firepower Management Center (FMC) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to obtain the device registration hash. This is due to insufficient sftunnel negotiation protection during initial device registration. An attacker in a man-in-the-middle position could intercept and modify sftunnel communication between FMC and FTD, potentially altering configuration or alert data.
Risk Assessment
The risk includes potential unauthorized modification of FTD device configuration, leading to compromised security integrity and confidentiality.
Recommendation
It is recommended to update FMC and FTD software to patched versions and implement authentication and encryption for sftunnel communication.
Other vulnerabilities in Cisco Firepower Management Center
See all- CVE-2016-6434High
Cisco Firepower Management Center version 6.0.1 has hardcoded database credentials, allowing local users to obtain sensitive information via CLI access.
- CVE-2016-6433High
The Threat Management Console in Cisco Firepower Management Center versions 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters.
- CVE-2016-6419High
CVE-2016-6419 is an SQL injection vulnerability in Cisco Firepower Management Center versions 4.10.3 through 5.4.0 that allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
- CVE-2022-20854High
A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). This is due to improper error handling when an SSH session fails. An attacker could exploit this by sending a high rate of crafted SSH connections, leading to resource exhaustion and reboot.
- CVE-2021-34764Medium
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more details, see the Details section of the Cisco advisory.
- CVE-2021-34762High
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack. The attacker would require valid device credentials. The issue is due to insufficient input validation of the HTTPS URL.
Original NVD description (English source)
A vulnerability in the sftunnel functionality of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to obtain the device registration hash. The vulnerability is due to insufficient sftunnel negotiation protection during initial device registration. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a specific flow of the sftunnel communication between an FMC device and an FTD device. A successful exploit could allow the attacker to decrypt and modify the sftunnel communication between FMC and FTD devices, allowing the attacker to modify configuration data sent from an FMC device to an FTD device or alert data sent from an FTD device to an FMC device.