cbcvebase.
CVE-2023-20048
published 2023-11-01

CVE-2023-20048: A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute…

PriorityP279critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EXPLOIT
EPSS
15.82%
96.5th percentile
A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense (FTD) device that is managed by the FMC Software. This vulnerability is due to insufficient authorization of configuration commands that are sent through the web service interface. An attacker could exploit this vulnerability by authenticating to the FMC web services interface and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to execute certain configuration commands on the targeted FTD device. To successfully exploit this vulnerability, an attacker would need valid credentials on the FMC Software.

Affected

81 ranges· showing 25
VendorProductVersion rangeFixed in
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——
ciscocisco_firepower_management_center——

Detection & IOCsextracted from sources · hover to see the quote

url/api/fmc_platform/v1/auth/generatetoken↗
url/api/fmc_config/v1/domain/{DOMAIN_UUID}/devices/devicerecords↗
url/api/fmc_config/v1/domain/{DOMAIN_UUID}/devices/devicerecords/{DEVICE_ID}/operational/command/{COMMAND}↗
cookieX-auth-access-token↗
cookieX-auth-refresh-token↗
  • →Monitor for POST requests to the FMC REST API token generation endpoint /api/fmc_platform/v1/auth/generatetoken followed by POST requests to the /operational/command/ sub-path on device records, which is the exploit chain used to execute unauthorized commands on FTD devices. ↗
  • →Alert on POST requests to paths matching /api/fmc_config/v1/domain/*/devices/devicerecords/*/operational/command/* on the FMC web services interface, as this is the specific endpoint abused to inject unauthorized configuration commands onto managed FTD devices. ↗
  • →Inspect HTTP request headers for the presence of X-auth-access-token used as an Authorization header in subsequent API calls after initial token generation — this is the authentication mechanism leveraged by the exploit. ↗
  • →Flag FTD devices running versions 6.2.3.18, 6.4.0.16, or 6.6.7.1 as vulnerable targets; the exploit explicitly checks for these version strings before attempting command execution. ↗
  • ·Exploitation requires valid FMC credentials — this is a post-authentication vulnerability, so detections should focus on authenticated API abuse rather than unauthenticated access attempts. ↗
  • ·There are no workarounds available; only patching resolves the vulnerability. ↗
  • ·The exploit uses a hardcoded example domain UUID (e276abec-e0f2-11e3-8169-6d9ed49b625f); real-world attackers would enumerate the actual domain UUID via the devicerecords API before proceeding. ↗

CVSS provenance

nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_cisco9.9CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.