CVE-2020-3253

published 2020-05-06

CVE-2020-3253: A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell…

medium 6.7 CVSS 3.1

AV L AC L PR H UI N S U C H I H A H

A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. The vulnerability is due to improper configuration of the support tunnel feature. An attacker could exploit this vulnerability by enabling the support tunnel, setting a key, and deriving the tunnel password. A successful exploit could allow the attacker to run any system command with root access on an affected device.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_firepower_threat_defense_software	—	—
cisco	firepower_threat_defense	< 6.5.0	6.5.0
cisco	firepower_threat_defense	—	—

CWE-284