CVE-2022-20743
published 2022-05-03CVE-2022-20743: A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass…
PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
3.90%
89.1th percentile
A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This vulnerability is due to improper validation of files uploaded to the web management interface of Cisco FMC Software. An attacker could exploit this vulnerability by uploading a maliciously crafted file to a device running affected software. A successful exploit could allow the attacker to store malicious files on the device, which they could access later to conduct additional attacks, including executing arbitrary code on the affected device with root privileges.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_firepower_management_center | — | — |
| cisco | firepower_management_center_file_upload_security | — | — |
| cisco | secure_firewall_management_center | < 6.4.0.15 | 6.4.0.15 |
| cisco | secure_firewall_management_center | >= 6.5.0 < 6.6.5.2 | 6.6.5.2 |
| cisco | secure_firewall_management_center | >= 6.7.0 < 7.0.2 | 7.0.2 |
| cisco | secure_firewall_management_center | >= 7.1.0 < 7.1.0.1 | 7.1.0.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is triggered via file upload through the web management interface of Cisco FMC; monitor for maliciously crafted file uploads to the FMC web UI by authenticated users ↗
- →Post-exploitation indicator: attacker stores malicious files on the device for later access; hunt for unexpected files stored on the FMC filesystem, particularly those accessible via the web interface ↗
- →Root cause is improper file validation (CWE-434: Unrestricted Upload of File with Dangerous Type); inspect web server logs on FMC for anomalous multipart/form-data POST requests uploading unexpected file types ↗
- ·Exploitation requires prior authentication; attack surface is limited to authenticated, remote attackers with access to the FMC web management interface ↗
- ·No workarounds are available; patching is the only remediation. Restrict access to the FMC web management interface to trusted hosts as a compensating control. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5cj7-j8hc-47xc: A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to b
ghsa_unreviewed·2022-05-04
CVE-2022-20743 [HIGH] CWE-434 GHSA-5cj7-j8hc-47xc: A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to b
A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This vulnerability is due to improper validation of files uploaded to the web management interface of Cisco FMC Software. An attacker could exploit this vulnerability by uploading a maliciously crafted file to a device running affected software. A successful exploit could allow the attacker to store malicious files on the device, which they could access later to conduct additional attacks, including executing arbitrary code on the affected device with root privileges.
Cisco
Cisco Firepower Management Center File Upload Security Bypass Vulnerability
vendor_cisco·2022-04-27·CVSS 6.5
CVE-2022-20743 [MEDIUM] CWE-434 Cisco Firepower Management Center File Upload Security Bypass Vulnerability
Cisco Firepower Management Center File Upload Security Bypass Vulnerability
A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system.
This vulnerability is due to improper validation of files uploaded to the web management interface of Cisco FMC Software. An attacker could exploit this vulnerability by uploading a maliciously crafted file to a device running affected software. A successful exploit could allow the attacker to store malicious files on the device, which they could access later to conduct additional attacks, including executing arbitrary code on the affected device with root privileges.
Cisco has released so
Cisco
Cisco Firepower Management Center File Upload Security Bypass Vulnerability
vendor_cisco·CVSS 3.1
CVE-2022-20743 Cisco Firepower Management Center File Upload Security Bypass Vulnerability
CVE-2022-20743: Cisco Firepower Management Center File Upload Security Bypass Vulnerability
A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This vulnerability is due to improper validation of files uploaded to the web management interface of Cisco FMC Software. An attacker could exploit this vulnerability by uploading a maliciously crafted file to a device running affected software. A successful exploit could allow the attacker to store malicious files on the device, which they could access later to conduct additional attacks, including executing arbitrary code on the affected device with root privileges. Cisco h
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-05-03
Published