CVE-2022-20949
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This is due to improper restriction of access to HTTPS endpoints. An attacker could exploit this by sending specific messages to the HTTPS handler, allowing configuration changes that should only be performed through Firepower Management Center (FMC).
Risk Assessment
The risk is that an attacker can make unauthorized configuration changes, potentially leading to security policy violations and improper operation.
Recommendation
Restrict access to the management interface to trusted networks only. Apply Cisco updates and monitor configuration changes.
Original NVD description (English source)
A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This vulnerability exists because access to HTTPS endpoints is not properly restricted on an affected device. An attacker could exploit this vulnerability by sending specific messages to the affected HTTPS handler. A successful exploit could allow the attacker to perform configuration changes on the affected system, which should be configured and managed only through Cisco Firepower Management Center (FMC) Software.