Cisco FirePOWER Management Center Unauthenticated Information Disclosure Vulnerability

A vulnerability in the Cisco FirePOWER Management Center could allow an unauthenticated, remote attacker to obtain information about the Cisco FirePOWER Management Center software version from the device login page.

The vulnerability is due to verbose output returned when HTML files are retrieved from the affected system. An attacker could exploit this vulnerability by reading the information disclosed in the help files to conduct further attacks.

Cisco has not released software updates that address this vulnerability. Workarounds that address this vulnerability are not available.

This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-fmc[“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-fmc”]