cbcvebase.
CVE-2022-20743
published 2022-05-03

CVE-2022-20743: A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass…

PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
3.90%
89.1th percentile
A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This vulnerability is due to improper validation of files uploaded to the web management interface of Cisco FMC Software. An attacker could exploit this vulnerability by uploading a maliciously crafted file to a device running affected software. A successful exploit could allow the attacker to store malicious files on the device, which they could access later to conduct additional attacks, including executing arbitrary code on the affected device with root privileges.

Affected

6 ranges
VendorProductVersion rangeFixed in
ciscocisco_firepower_management_center
ciscofirepower_management_center_file_upload_security
ciscosecure_firewall_management_center< 6.4.0.156.4.0.15
ciscosecure_firewall_management_center>= 6.5.0 < 6.6.5.26.6.5.2
ciscosecure_firewall_management_center>= 6.7.0 < 7.0.27.0.2
ciscosecure_firewall_management_center>= 7.1.0 < 7.1.0.17.1.0.1

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability is triggered via file upload through the web management interface of Cisco FMC; monitor for maliciously crafted file uploads to the FMC web UI by authenticated users
  • Post-exploitation indicator: attacker stores malicious files on the device for later access; hunt for unexpected files stored on the FMC filesystem, particularly those accessible via the web interface
  • Root cause is improper file validation (CWE-434: Unrestricted Upload of File with Dangerous Type); inspect web server logs on FMC for anomalous multipart/form-data POST requests uploading unexpected file types
  • ·Exploitation requires prior authentication; attack surface is limited to authenticated, remote attackers with access to the FMC web management interface
  • ·No workarounds are available; patching is the only remediation. Restrict access to the FMC web management interface to trusted hosts as a compensating control.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.