Improper Encryption of Sensitive Information in FMC GUI Configuration Manager Could Lead to Information Disclosure

CVE-2021-34751

Summary

A vulnerability affecting the web-based GUI configuration manager of Cisco Firepower Management Center Software enables an authenticated remote attacker to exploit weak encryption mechanisms. By possessing low privilege credentials on the impacted device, an attacker can access sensitive configuration information where parameters may be displayed in clear text. This flaw poses significant risks to information security, as it facilitates unauthorized visibility into crucial settings, potentially leading to further exploitation of the system. Cisco has released updates to mitigate this risk, and users are strongly encouraged to apply these patches immediately.

References