Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
Higher than 49% of scored CVEs
DescriptionNVD
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists because a registered sftunnel peer has incorrect permissions to write an arbitrary file to any location on the device. An attacker could exploit this vulnerability by hijacking the sftunnel communication connection or being a valid registered sftunnel peer and sending an sftunnel command to write a malicious file to the disk of an affected device. A successful exploit could allow the attacker to write a file to the device that is executed with root privileges. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 17 Sep.
- Cisco Patches Firewall Flaws Enabling Unauthenticated Root AccessSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.