← Back

CVE-2022-20949

nvd nist
Published: Nov 15, 2022Modified: Nov 21, 2024

JSON object

Loading...
4.9
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Exploitability: 1.2 / Impact: 3.6
Source: NVD

Description

A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This vulnerability exists because access to HTTPS endpoints is not properly restricted on an affected device. An attacker could exploit this vulnerability by sending specific messages to the affected HTTPS handler. A successful exploit could allow the attacker to perform configuration changes on the affected system, which should be configured and managed only through Cisco Firepower Management Center (FMC) Software.

Affected (16)

Cisco
1 product
Firepower Threat Defense
Configuration A
16 vulnerable
Vulnerable SoftwareAffected Versions
Cisco
Firepower Threat Defense
From 6.1.0 to 6.1.0.7
Firepower Threat Defense
From 6.2.0 to 6.2.0.6
Firepower Threat Defense
From 6.2.2 to 6.2.2.5
Firepower Threat Defense
From 6.2.3 to 6.2.3.18
Firepower Threat Defense
From 6.3.0 to 6.3.0.5
Firepower Threat Defense
From 6.4.0 to 6.4.0.15
Firepower Threat Defense
From 6.5.0 to 6.5.0.5
Firepower Threat Defense
From 6.6.0 to 6.6.5.2
Firepower Threat Defense
From 6.7.0 to 6.7.0.3
Firepower Threat Defense
From 7.0.0 to 7.0.3
Firepower Threat Defense
Version 6.2.1
Firepower Threat Defense
Version 7.1.0.0
Firepower Threat Defense
Version 7.1.0.1
Firepower Threat Defense
Version 7.1.0.2
Firepower Threat Defense
Version 7.2.0.1
Firepower Threat Defense
Version 7.2.0

Related CWEs

CWE-399
CWE-399

References (2)

Source: psirt@cisco.com
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.