CVE-2026-20131-Post-Incident-Written-Report

CVE-2026-20131-事后事件书面报告 本事后事件报告分析了CVE-2026-20131的利用情况，这是思科安全防火墙管理中心（FMC）中一个严重的零日未认证远程代码执行（RCE）漏洞。本文档涵盖了通过Java对象反序列化（CWE-502）的初始入侵向量、Interlock勒索软件组织使用的威胁行为者战术、网络枚举工作流程以及取证时间线。它详细说明了根本原因调查结果、关于网络分段的经验教训，以及涵盖即时修补、账户审计和零信任实施的分阶段修复策略。...

CVE-2023-20178

CVE-2023-20178 这是Cisco Secure Client（测试版本5.0.01242）和Cisco AnyConnect（测试版本4.10.06079）中任意文件删除漏洞的PoC。 当用户连接到VPN时，vpndownloader.exe进程会在后台启动，并在c:\windows\temp目录下创建具有默认权限的目录，格式如下：.tmp。创建此目录后，vpndownloader.exe会检查该目录是否为空，如果不为空，则会删除其中的所有文件/目录。这种行为可被滥用以NT Authority\SYSTEM账户权限执行任意文件删除操作。...

CVE-2026-20131

CVE-2026-20131 — Cisco Secure FMC 远程代码执行（Java 反序列化） 严重性： 严重（CVSS 3.1：10.0 ） CWE： CWE-502 — 不可信数据的反序列化 受影响产品： Cisco Secure Firewall Management Center FMC 软件 安全公告： cisco-sa-fmc-rce-NKhnULJh Bug ID： CSCwt14636 概述 Cisco Secure Firewall Management Center FMC 软件基于 Web 的管理界面中存在一个漏洞，允许未经身份验证的远程攻击者 在受影响设备...

CVE-2025-20393

CVE-2025-20393 📌 概述 CVE-2025-20393 是一个影响 Cisco Secure Email Gateway SEG 和 Cisco Secure Email and Web Manager SEWM 设备上运行的 Cisco AsyncOS 的 严重远程命令执行 RCE 漏洞。 该漏洞源于 Spam Quarantine 功能中的 输入验证不当 。未经身份验证的远程攻击者 可通过发送特制的 HTTP 请求来利用此漏洞，从而导致 以 root 权限执行任意命令 。 该漏洞被认定为 极其危险 ，原因如下： 无需身份验证 可通过网络进行利用 可实现系统完全沦陷...

CVE-2026-76461-Detection-Kit-

CVE-2026-76461 — 检测与响应工具包 针对 CVE-2026-76461 的检测、狩猎和修复资源，该漏洞是 Cisco Secure Email Gateway SEG 的 Cisco AsyncOS 中的一个严重 SQL 注入漏洞。 ⚠️ 免责声明 本仓库仅包含防御性内容 ：Sigma 规则、YARA 规则、技术分析、入侵指标以及修复指南。 它不包含漏洞利用代码、PoC 或武器化工具。 该漏洞已被添加到 CISA 的已知被利用漏洞 KEV 目录中。在发布时，不存在公开的可运行 PoC。请仅在授权环境中使用这些资源。 📌 漏洞摘要 字段| 值 ---|--- CVE|...

cisco-CVE-2023-20075

关于 安全研究员: ly1g3, ly1g3attuta.io GPG 指纹: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 概述: 本地权限提升与 Shell 逃逸 CVE: CVE-2023-20075 时间线: 发现 - ly1g3 报告 - ly1g3 修复 - Cisco Cisco AsyncOS 14.2.0 ESA Cisco Secure Email 权限提升 - cli 到 root shell 拥有 cli 访问权限的已认证用户可以提升权...

cisco-CVE-2023-20009

关于 安全研究员：ly1g3，ly1g3attuta.io GPG 指纹：https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 概述：远程代码执行 - RCE from config file（由配置文件触发的远程代码执行） CVE：CVE-2023-20008 时间线： 发现 - ly1g3 上报 - ly1g3 修复 - Cisco Cisco AsyncOS 14.2.0 ESA（Cisco Secure Email）与 Cisco Secure Email a...

CVE-2026-20079

CVE-2026-20079 Cisco Secure FMC PoC Python proof of concept for the publicly documented Cisco Secure Firewall Management Center authentication-bypass-to-root-RCE chain in CVE-2026-20079. This is not a new vulnerability or independently developed exploit chain. It is a clean-room implementation of...

Cisco Secure Firewall Management Center Software Vulnerabilities (cisco-sa-fmc-mulivulns-4PsnFwvx)

According to its self-reported version, Cisco Secure Firewall Management Center FMC is affected by multiple vulnerabilities. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

CVE-2026-20079

🚨 CVE-2026-20079 "Cisco FMC 严重零日漏洞" Cisco Secure Firewall Management Center 中导致 Root RCE 的严重身份验证绕过 📋 概述 CVE-2026-20079 是 Cisco Secure Firewall Management Center FMC 软件 Web 界面中的一个严重漏洞。 未经身份验证的远程攻击者 可以绕过身份验证，并在底层操作系统上以 root 权限 执行任意脚本。 CVE ID : CVE-2026-20079 CWE : CWE-288（使用备用路径或通道绕过身份验证） CVSS v3.1...

Cisco Secure Firewall Threat Defense Software sftunnel Authentication Bypass (cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3)

According to its self-reported version, Cisco Secure Firewall Threat Defense FTD Software is affected by multiple vulnerabilities. - A denial of service DoS vulnerability exists in the sftunnel functionality due to improper memory management. An unauthenticated, remote attacker can exploit this...

Cisco Secure Firewall Management Center Software sftunnel Authentication Bypass (cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3)

According to its self-reported version, Cisco Secure Firewall Management Center FMC is affected by multiple vulnerabilities. - A denial of service DoS vulnerability exists in the sftunnel functionality due to improper memory management. An unauthenticated, remote attacker can exploit this issue,...

Cisco Secure Firewall Threat Defense Software TLS 1.3 DoS (cisco-sa-ftd-tls1-3-dos-dLxwFWgF)

According to its self-reported version, Cisco Secure Firewall Threat Defense FTD Software is affected by a denial of service vulnerability. A flaw exists within the TLS 1.3 implementation due to improper buffer management. An unauthenticated, remote attacker can exploit this issue, via a crafted...

CVE-2026-76412

A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An...

CVE-2026-20340

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by...

CVE-2026-20344

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of...

CVE-2026-20335

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal securi...

CVE-2026-20336

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal securi...

CVE-2026-20342

A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. This vulnerability exists because user input is not being sanitized. An attacker could exploit this vulnerability by...

CVE-2026-20343

A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeated...