Unauthenticated Local Attackers Can Access Affected Systems via Static Credentials

CVE-2024-20412

Summary

Cisco Firepower Threat Defense Software is exposed to a significant vulnerability that enables an unauthenticated local attacker to gain access to the system via static credentials. This vulnerability arises from hard-coded passwords embedded within static accounts on the affected devices. If exploited, an attacker could log in to the Command Line Interface (CLI) and potentially access restricted data, execute basic troubleshooting commands, modify configuration settings, or compromise the device's operational capacity, potentially rendering it inoperable and necessitating a complete reimage. This poses serious risks to network security and system integrity for affected Cisco Firepower Series devices.

References