Cisco Firepower Threat Defense Software vulnerabilities

A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthenticated, local attacker to access an affected system using static credentials. The issue is due to the presence of static accounts with hard-coded passwords.

A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, FirePOWER Services Software for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to improper reassembly of traffic streams. An attacker could exploit this by sending crafted streams through an affected device, potentially delivering malicious requests to protected systems.

A vulnerability in the TLS 1.3 implementation of Cisco FTD Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This is due to a logic error in memory allocation handling during a TLS 1.3 session. An attacker could send a crafted TLS 1.3 message sequence to cause a reload, resulting in a DoS condition.

A vulnerability in the inter-device communication mechanisms between Cisco Firepower Threat Defense (FTD) Software and Cisco Firepower Management (FMC) Software could allow an authenticated, local attacker to execute arbitrary commands with root permissions on the underlying operating system of an affected device. This is due to insufficient validation of user-supplied input. An attacker could exploit this by accessing the expert mode and submitting specific commands, potentially executing code in the context of FMC or FTD.

A vulnerability in the SSL file policy implementation of Cisco FTD Software during SSL/TLS inspection with a URL Category could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This is due to a logic error when inspecting SSL/TLS connections with URL Category configured. An attacker could send a crafted SSL/TLS connection to trigger a reload, resulting in bypass or DoS.

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device running in multi-instance mode. This is due to insufficient validation of user-supplied command arguments. An attacker could exploit this by submitting crafted input, leading to root command execution.

A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a device reload, causing a denial of service (DoS). The issue is due to insufficient validation of SSL/TLS messages during software-based decryption. Exploitation involves sending a crafted SSL/TLS message through the device.

A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker to overwrite files on the file system using directory traversal techniques. This is due to insufficient validation of user input for the file path in a specific CLI command. A successful exploit could cause system instability if important system files are overwritten.

A vulnerability in the ingress packet processing path of Cisco FTD Software for interfaces configured as Inline Pair or in Passive mode could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS). The issue is due to insufficient validation when processing Ethernet frames. An attacker could exploit this by sending malicious Ethernet frames. Consequences may include filling the /ngfw partition, preventing login and boot, or causing a process crash leading to reload.

A vulnerability in the ICMP ingress packet processing of Cisco Firepower Threat Defense (FTD) Software for Firepower 4110 appliances could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to incomplete input validation upon receiving ICMP packets. Exploitation involves sending a high number of crafted ICMP or ICMPv6 packets.

A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to inefficient memory management. Exploitation involves sending a large number of TCP packets to a specific port.

A vulnerability in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. The issue is due to insufficient protections on a configuration file used at container startup. An attacker could modify this file, leading to root command execution and impacting other FTD instances or the host Cisco FXOS device.

A vulnerability in the TLS 1.3 policy with URL category functionality for Cisco FTD Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL. The issue is due to a logic error with Snort handling of the connection with the TLS 1.3 policy and URL category configuration. An attacker could exploit this by sending crafted TLS 1.3 connections, bypassing the policy and accessing URLs that would normally be dropped.

A vulnerability in how Cisco FTD Software handles session timeouts for management connections could allow an unauthenticated, remote attacker to cause a buildup of remote management connections, leading to a DoS condition. The issue is that the default session timeout period for specific to-the-box remote management connections is too long. An attacker could exploit this by sending a large and sustained number of crafted remote management connections.

A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to insufficient normalization of a text-based payload. An attacker could exploit this by sending traffic with specifically obfuscated payloads through an affected device.

A vulnerability in the PAM configuration of Cisco Firepower Threat Defense (FTD), Firepower Management Center (FMC), and FXOS Software could allow an authenticated, remote attacker to cause a DoS condition. The issue is due to improper resource management in user session management. An attacker could exploit this by connecting and performing many simultaneous successful SSH logins, exhausting system resources and causing a device reload.

Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. These vulnerabilities are due to insufficient protections on the underlying filesystem. An attacker could exploit these by modifying critical files, leading to root command execution and impacting other FTD instances.

Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. These vulnerabilities are due to insufficient protections on the underlying filesystem. An attacker could exploit these by modifying critical files, leading to root command execution and impacting other FTD instances.

A vulnerability in the SSL/TLS protocol inspection engine of Cisco FTD Software could allow an unauthenticated, remote attacker to bypass configured file policies on an affected system. The issue is due to errors when handling specific SSL/TLS messages. An attacker could exploit this by sending crafted HTTP packets through the system, bypassing policies and delivering a malicious payload to the protected network.

A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remote attacker to cause an unexpected restart of the SNORT detection engine, resulting in a denial of service (DoS) condition. The issue is due to incomplete error handling of SSL/TLS packet headers during connection establishment. An attacker could send a crafted SSL/TLS packet during the handshake, causing the engine to restart and leading to partial DoS.

A vulnerability in the logging subsystem of the Cisco Firepower Threat Defense (FTD) Firepower Device Manager (FDM) could allow an unauthenticated, remote attacker to add arbitrary entries to the audit log. This affects FTD Software versions 6.1.x on specific products with FDM enabled. An attacker could exploit this to manipulate the audit log, potentially hiding unauthorized actions.