CVE Vulnerability Catalog

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. The issue is due to unsecured deserialization of web-management user-controlled data. The attacker must have valid credentials with at least the role of Security Analyst (read-only).

A vulnerability in Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software relates to improper control of a resource through its lifetime, grouped under CWE-664. It was discovered during an internal security review and addressed in a software hardening release.

A vulnerability in Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software relates to incorrect calculation issues, grouped under CWE-682. It was discovered during an internal security review and addressed in a software hardening release.

Vulnerability in Cisco Secure ASA, FTD, and FMC software due to improper adherence to coding standards (CWE-710). It was discovered during an internal security review and addressed in a hardening release.

Vulnerability in Cisco Secure ASA, FTD, and FMC software due to incorrect comparison conditions (CWE-697). It was discovered during an internal security review and addressed in a hardening release.

Vulnerabilities in Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software are related to improper access control issues (CWE-284). They were discovered during an internal security review and have been addressed in a software hardening release.

Vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC and FTD Software allows an unauthenticated, adjacent attacker to impersonate the peer device and gain access at the manager role level (root). This is due to improper management of the TLS certificate for the sftunnel connection.

The web-based management interface of Cisco Identity Services Engine (ISE) does not properly validate user-supplied input, allowing an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack. By persuading a user to click a crafted link, the attacker can execute arbitrary script code in the context of the interface or access sensitive browser-based information.

Vulnerability in Cisco ISE allows an authenticated, remote attacker to perform SQL injection attacks on an affected device. Low-privileged administrative credentials are required. This is due to improper validation of user-supplied input.

Vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC and FTD Software allows an unauthenticated, remote attacker to exhaust the available memory of an affected device. This is due to improper management of memory resources during sftunnel TLS connection setup.

Incomplete validation of SSL certificates in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software allows an unauthenticated remote attacker to cause the engine to restart. The attacker sends a crafted SSL connection setup request, resulting in a denial of service (DoS) condition.

An internal security review by Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams revealed multiple vulnerabilities related to improper privilege management (CWE-269). A software hardening release addressing these internally discovered issues has been made available.

Lack of server-side validation of Administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) allows an authenticated remote attacker to modify parts of the configuration. The attacker submits a crafted HTTP request to modify descriptions of files on a specific page.

Lack of server-side validation of Administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to modify parts of the configuration. The attacker submits a crafted HTTP request to modify descriptions of files on a specific page.

A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This is due to insufficient validation of user-supplied input in REST API calls. A successful exploit could allow the attacker to view or modify data on the underlying database, and in single-node deployments could cause a DoS condition.

Insufficient validation of user-supplied input in IPsec Open API calls in Cisco ISE allows an authenticated remote attacker to inject arbitrary commands on the underlying operating system. Exploitation requires valid administrative credentials and a node with more than one network interface, one of which is an active IPsec tunnel.

Insufficient validation of user-supplied input in Cisco ISE allows an authenticated remote attacker to obtain write access on the underlying operating system. The attacker sends a crafted HTTP request, and exploitation requires valid administrative credentials.

Vulnerability in DTLS message handling of Cisco Secure Firewall ASA and FTD Software for 3100 and 4200 Series devices allows an unauthenticated, remote attacker to cause a DoS condition. This is due to improper resource management when processing certain DTLS messages.

Vulnerability in the certification authentication feature of IKEv2 for Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause an unexpected device reload. This is due to a logic error during the certificate authentication phase of IKEv2 connection setup.

A logic error when parsing a DNS query and tracking incoming buffer sizes in the DNS over TCP implementation of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated remote attacker to restart the TCP DNS response handler and reload the device. The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.