Cisco Cisco Firepower Threat Defense Software and Cisco Firepower Management Center Code Injection Vulnerability

CVE-2023-20063

Summary

A design flaw in the communication protocols between Cisco Firepower Threat Defense (FTD) and Cisco Firepower Management (FMC) software allows authenticated local attackers with administrative rights to exploit this vulnerability. By entering specially crafted commands in expert mode, they can execute arbitrary code on the underlying operating system of the associated device, which could compromise the security of the entire infrastructure. This exploitation requires that the attacker is already authenticated and has a certain level of privileges on the affected devices.

References