Lucene search

[email protected]CVE-2022-20926

HistoryNov 15, 2022 - 9:15 p.m.

CVE-2022-20926

2022-11-1521:15:32

CWE-78

CWE-77

[email protected]

web.nvd.nist.gov

cve-2022-20926

cisco

fmc

vulnerability

web management interface

remote attacker

arbitrary commands

authentication

command execution

api

endpoint

low system privileges

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.7%

JSON

A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system.

The vulnerability is due to insufficient validation of user-supplied parameters for certain API endpoints. An attacker could exploit this vulnerability by sending crafted input to an affected API endpoint. A successful exploit could allow an attacker to execute arbitrary commands on the device with low system privileges. To successfully exploit this vulnerability, an attacker would need valid credentials for a user with Device permissions: by default, only Administrators, Security Approvers and Network Admins user accounts have these permissions.

Affected configurations

NVD

Node

ciscofirepower_management_centerMatch7.0.0

ciscofirepower_management_centerMatch7.0.0.1

ciscofirepower_management_centerMatch7.0.1

ciscofirepower_management_centerMatch7.0.1.1

ciscofirepower_management_centerMatch7.0.2

ciscofirepower_management_centerMatch7.0.2.1

ciscofirepower_management_centerMatch7.0.3

ciscofirepower_management_centerMatch7.0.4

ciscofirepower_management_centerMatch7.1.0

ciscofirepower_management_centerMatch7.1.0.1

ciscofirepower_management_centerMatch7.1.0.2

CPENameOperatorVersion
cisco:firepower_management_centercisco firepower management centereq7.0.0
cisco:firepower_management_centercisco firepower management centereq7.0.0.1
cisco:firepower_management_centercisco firepower management centereq7.0.1
cisco:firepower_management_centercisco firepower management centereq7.0.1.1
cisco:firepower_management_centercisco firepower management centereq7.0.2
cisco:firepower_management_centercisco firepower management centereq7.0.2.1
cisco:firepower_management_centercisco firepower management centereq7.0.3
cisco:firepower_management_centercisco firepower management centereq7.0.4
cisco:firepower_management_centercisco firepower management centereq7.1.0
cisco:firepower_management_centercisco firepower management centereq7.1.0.1

CPE	Name	Operator	Version
cisco:firepower_management_center	cisco firepower management center	eq	7.0.0
cisco:firepower_management_center	cisco firepower management center	eq	7.0.0.1
cisco:firepower_management_center	cisco firepower management center	eq	7.0.1
cisco:firepower_management_center	cisco firepower management center	eq	7.0.1.1
cisco:firepower_management_center	cisco firepower management center	eq	7.0.2
cisco:firepower_management_center	cisco firepower management center	eq	7.0.2.1
cisco:firepower_management_center	cisco firepower management center	eq	7.0.3
cisco:firepower_management_center	cisco firepower management center	eq	7.0.4
cisco:firepower_management_center	cisco firepower management center	eq	7.1.0
cisco:firepower_management_center	cisco firepower management center	eq	7.1.0.1

Rows per page:

1-10 of 111

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Firepower Management Center",
    "versions": [
      {
        "version": "7.0.0",
        "status": "affected"
      },
      {
        "version": "7.0.0.1",
        "status": "affected"
      },
      {
        "version": "7.0.1",
        "status": "affected"
      },
      {
        "version": "7.0.1.1",
        "status": "affected"
      },
      {
        "version": "7.0.2",
        "status": "affected"
      },
      {
        "version": "7.0.2.1",
        "status": "affected"
      },
      {
        "version": "7.0.3",
        "status": "affected"
      },
      {
        "version": "7.0.4",
        "status": "affected"
      },
      {
        "version": "7.1.0",
        "status": "affected"
      },
      {
        "version": "7.1.0.1",
        "status": "affected"
      },
      {
        "version": "7.1.0.2",
        "status": "affected"
      }
    ]
  }
]