Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Command Injection Vulnerability

TL;DR 📌

A command injection vulnerability has been identified in Cisco Secure Firewall Management Center (FMC) and Secure Firewall Threat Defense (FTD) Software. This medium-severity issue allows authenticated local attackers to execute arbitrary commands on the underlying operating system. Cisco has released software updates to address this vulnerability, but no workarounds are available.

What happened 🕵️‍♂️

A vulnerability in the command-line interface (CLI) of Cisco Secure Firewall Management Center (FMC) and Secure Firewall Threat Defense (FTD) Software has been discovered. This flaw arises from improper input validation for specific CLI commands, enabling an authenticated local attacker to inject operating system commands. If exploited, the attacker could escape the restricted command prompt and execute arbitrary commands as root on the underlying operating system. Successful exploitation requires valid Administrator credentials.

Affected products 🖥️

• Cisco Secure Firewall Management Center Software
• Cisco Secure Firewall Threat Defense Software

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address this vulnerability.

Risk in context 🎯

The highest CVSS score for this vulnerability is 6.0, categorizing it as Medium severity. The risk is primarily driven by the requirement for valid Administrator credentials, which limits exposure to authenticated users. However, if an attacker gains access to the system, they could potentially exploit this vulnerability to escalate privileges.

Fast facts ⚡

• Vulnerability Type: Command Injection
• CVSS Score: 6.0 (Medium)
• Impact: Arbitrary command execution as root
• Authentication Required: Yes (Administrator credentials)
• Workarounds: None available

For leadership 🧭

Executive summary. A flaw in the CLI of Cisco Secure Firewall Management Center and Threat Defense software lets someone with Administrator credentials escape the restricted prompt and gain root on the appliance’s operating system. It is rated medium severity since it requires existing admin access, but it should still be scheduled into the next patching cycle given the breadth of affected firewall hardware.

Why it matters:

• Affects a wide range of deployed hardware, including Firepower 1000/2100/4100/9000 Series, Secure Firewall 1200/3100/4200 Series, ISA 3000, and FMC appliances, meaning many firewall management and enforcement points are potentially in scope.
• An attacker with valid Administrator CLI credentials can move from the restricted command prompt to full root access on the underlying OS, exceeding what the Administrator role is designed to allow.
• No workarounds exist, so exposure cannot be reduced through configuration changes alone – the software must be updated.
• Because FMC centrally manages Firepower/Threat Defense sensors, root compromise of the management platform could affect oversight of every firewall it controls.

Now / Next / Later:

• Now: Identify every FMC and FTD instance in your estate and check which software train each is running against Cisco’s fixed-release table.
• Next: Schedule an upgrade to the first fixed release for each affected FMC and FTD product line during your next maintenance window, since no workaround is available.
• Later: Tighten who holds Administrator-level CLI credentials on firewall management platforms and review admin access regularly, since this flaw depends entirely on that level of access being reachable.