A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software’s web-based management interface.
This vulnerability could potentially allow authenticated, remote attackers to conduct SQL injection attacks on affected systems.
This vulnerability, tracked as CVE-2024-20360, poses significant risks, including unauthorized data access, command execution on the underlying operating system, and privilege escalation to root.
The vulnerability exists due to inadequate user input validation within the web-based management interface of Cisco FMC Software.
ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service
An attacker with at least Read Only user credentials can exploit this flaw by sending crafted SQL queries to the affected system.
Successful exploitation could lead to severe consequences, such as:
This vulnerability affects devices running a vulnerable release of Cisco FMC Software, regardless of the device configuration.
Cisco has confirmed that Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software are unaffected by this vulnerability.
Cisco has released software updates to address this critical vulnerability.
No workarounds are available, so users need to apply the updates promptly.
Customers with service contracts can obtain the necessary security fixes through their usual update channels.
Those without service contracts can contact the Cisco Technical Assistance Center (TAC).
Users are advised to consult the official Cisco Security Advisory for detailed information on the affected software releases and the fixed versions.
Cisco strongly recommends that all users of affected Cisco FMC Software versions upgrade to the fixed software releases to mitigate the risks associated with this vulnerability.
Users should ensure their devices have sufficient memory and that current hardware and software configurations are compatible with the new release.
For further assistance and to determine their exposure to vulnerabilities, users can utilize the Cisco Software Checker tool, which is available on the Cisco website.
The discovery of CVE-2024-20360 underscores the importance of regular software updates and vigilant security practices.
Organizations using Cisco FMC Software should act swiftly to apply the necessary updates and protect their systems from potential exploitation.
Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers
Microsoft Teams users across the globe are experiencing significant disruptions in file-sharing capabilities due to…
Cloud computing has transformed the way organizations operate, offering unprecedented scalability, flexibility, and cost savings.…
Security awareness has become a critical component of organizational defense strategies, particularly as companies adopt…
Security researchers have unveiled a new malware process injection technique dubbed "Waiting Thread Hijacking" (WTH),…
The global regulatory landscape for cybersecurity is undergoing a seismic shift, with the European Union’s…
A sophisticated new malware suite targeting macOS, dubbed "PasivRobber," has been discovered by security researchers.…