CVE-2020-3550
published 2020-10-21CVE-2020-3550: A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an…
PriorityP356high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
2.21%
80.6th percentile
A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricted path. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using a relative path in specific sfmgr commands. An exploit could allow the attacker to read or write arbitrary files on an sftunnel-connected peer device.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_firepower_management_center | — | — |
| cisco | firepower_management_center | — | — |
| cisco | firepower_threat_defense | <= 6.0.1 | — |
| cisco | firepower_threat_defense | — | — |
| cisco | firepower_threat_defense | — | — |
| cisco | firepower_threat_defense | >= 6.3.0 < 6.3.0.6 | 6.3.0.6 |
| cisco | firepower_threat_defense | >= 6.4.0 < 6.4.0.10 | 6.4.0.10 |
| cisco | secure_firewall_management_center | <= 6.0.1 | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | >= 6.3.0 < 6.3.0.6 | 6.3.0.6 |
| cisco | secure_firewall_management_center | >= 6.4.0 < 6.4.0.10 | 6.4.0.10 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
vendor_cisco8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Firepower Management Center Software and Firepower Threat Defense Software Directory Traversal Vulnerability
vendor_cisco·2020-10-21·CVSS 8.1
CVE-2020-3550 [HIGH] CWE-22 Cisco Firepower Management Center Software and Firepower Threat Defense Software Directory Traversal Vulnerability
Cisco Firepower Management Center Software and Firepower Threat Defense Software Directory Traversal Vulnerability
A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricted path.
The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using a relative path in specific sfmgr commands. An exploit could allow the attacker to read or write arbitrary files on an sftunnel-connected peer device.
Cisco has released software updates that address the vulnerability described in this advisory. There are no workarounds that address this vulnerability.
Cisco
Cisco Firepower Management Center Software and Firepower Threat Defense Software Directory Traversal Vulnerability
vendor_cisco·CVSS 3.0
CVE-2020-3550 Cisco Firepower Management Center Software and Firepower Threat Defense Software Directory Traversal Vulnerability
CVE-2020-3550: Cisco Firepower Management Center Software and Firepower Threat Defense Software Directory Traversal Vulnerability
A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricted path. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using a relative path in specific sfmgr commands. An exploit could allow the attacker to read or write arbitrary files on an sftunnel-connected peer device. Cisco has released software updates that address the vulnerability described in this advisory. There are no
CVSS: 3.0
CWE: CWE-22, CWE-22
B
GHSA
GHSA-7ghh-24j7-vmm8: A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow
ghsa_unreviewed·2022-05-24
CVE-2020-3550 [HIGH] CWE-22 GHSA-7ghh-24j7-vmm8: A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow
A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricted path. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using a relative path in specific sfmgr commands. An exploit could allow the attacker to read or write arbitrary files on an sftunnel-connected peer device.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-10-21
Published