CVE-2024-20300

CVE-2024-20300 affects Cisco Firepower Management Center (FMC) Software, targeting the web-based management interface. The issue is caused by insufficient validation of user-supplied input in the FMC web UI, enabling an authenticated, remote attacker to perform a cross-site scripting (XSS) attack...

CVE-2024-20374

Cisco Secure Firewall Management Center (FMC) Command Injection (CVE-2024-20374) affects FMC web-based management interface. The root cause is insufficient input validation of certain HTTP request parameters, enabling an authenticated administrator to execute arbitrary commands on the underlying ...

CVE-2016-1431

Cisco Firepower Management Center is affected by CVE-2016-1431: an XSS vulnerability in the HTTP framework allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted URL. Affected versions include FMC 4.10.3 and 5.2.0–5.4.0 (including 5.3.0/5.3.1 as listed in sou...

CVE-2017-3814

Cisco Firepower System Software contains a vulnerability (CVE-2017-3814) that could allow an unauthenticated remote attacker to bypass the appliance’s web content blocking. The issue is caused by insufficient input validation in the URL handling logic, enabling an attacker to add malicious text t...

CVE-2018-0281

Cisco Firepower System Software is affected by CVE-2018-0281, where the Snort detection engine can be restarted remotely due to improper handling of a TLS extension during TLS setup. This unauthenticated abuse leads to a brief DoS on the affected device. The issue specifically involves the TLS ex...

CVE-2019-12685

Cisco Firepower Management Center (FMC) web-based management interface contains multiple SQL injection vulnerabilities due to improper input validation. An authenticated, remote attacker could craft SQL queries to view or modify data and potentially execute commands in the underlying OS, impactin...

CVE-2019-12687

CVE-2019-12687 affects Cisco Firepower Management Center (FMC) via the web UI. The root cause is insufficient input validation in the web UI, enabling an authenticated, remote attacker to execute arbitrary commands on the FMC. The issue is associated with FMC web UI components and has high impact...

CVE-2020-3302

CVE-2020-3302 refers to a vulnerability in the web UI of Cisco Firepower Management Center (FMC) where insufficient input validation lets an authenticated, remote attacker upload a crafted file to overwrite files on the device’s filesystem. The issue is documented across multiple sources (Cisco a...

CVE-2023-20206

Cisco Firepower Management Center (FMC) web-based management interface is affected by stored cross-site scripting (XSS) vulnerabilities due to insufficient input validation. An unauthenticated, remote attacker could insert crafted input in various interface fields to execute arbitrary script code...

CVE-2024-20471

Cisco Secure Firewall Management Center (FMC) Software is affected by a SQL injection vulnerability in its web-based management interface. The issue stems from inadequate input validation in the admin-facing interface, requiring Administrator privileges and an authenticated session to exploit. Su...

CVE-2019-12681

CVE-2019-12681 affects Cisco Firepower Management Center (FMC) web-based management interface. The vulnerabilities arise from improper input validation, enabling an authenticated, remote attacker to perform arbitrary SQL injections via crafted queries. Impact described in sources includes unautho...

CVE-2019-1832

The CVE-2019-1832 entry describes a vulnerability in the detection engine of Cisco Firepower Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to bypass configured access control policies by sending crafted ICMP packets. Root cause: improper validation of ICMP pac...

CVE-2017-6717

Cisco Firepower Management Center (FMC) is affected by CVE-2017-6717, a cross-site scripting (XSS) vulnerability in the FMC web framework. An authenticated, remote attacker could exploit this via the web interface to target a FMC user. Affected releases include 6.0.1.3 and 6.2.1; fixed in 6.2.1 (...

CVE-2019-1833

CVE-2019-1833 affects Cisco Firepower Threat Defense Software: an SSL/TLS parser issue that permits an unauthenticated remote attacker to bypass configured policies by exploiting improper parsing of TLS packet header attributes. Exploitation could allow uninspected traffic to pass through the sys...

CVE-2017-3885

CVE-2017-3885 is a vulnerability in the Cisco Firepower System Software detection engine reassembly of SSL packets that can be exploited by an unauthenticated, remote attacker to cause a DoS by driving the Snort process to high CPU usage. Affected releases include Cisco Firepower System Software ...

CVE-2020-3553

CVE-2020-3553 affects Cisco Firepower Management Center (FMC) Web UI. Multiple XSS vulnerabilities arise from insufficient validation in the web-based management interface, allowing an unauthenticated, remote attacker to lure a user via a crafted link and execute arbitrary script code or view sen...

CVE-2024-20372

Cisco Firepower Management Center (FMC) faces CVE-2024-20372: an unauthenticated, remote attacker can exploit a stored XSS via the web-based management interface due to insufficient input validation. Affected component is the FMC web UI; exploit could run arbitrary script in the interface context...

CVE-2019-12684

Cisco Firepower Management Center (FMC) has multiple SQL injection vulnerabilities in its web-based management interface (CVE-2019-12684). Exploitation relies on improper input validation and authenticated remote access, enabling attackers to view or modify data and potentially execute commands o...

CVE-2020-3301

CVE-2020-3301 relates to static credential vulnerabilities in Cisco Firepower Management Center (FMC) and Cisco Firepower User Agent Software. Connected sources (CISCO-SA-FMCUA-STATCRED-WEECCZCT, CVE listings, PT-2020-2510) describe the issue as involving hard-coded/static credentials or trust-ma...

CVE-2024-20364

CVE-2024-20364 affects Cisco Firepower Management Center (FMC) Software. The issue is a stored cross-site scripting (XSS) vulnerability in the web-based management interface caused by insufficient validation of user-supplied input, allowing an authenticated, remote attacker to inject crafted inpu...

CVE-2024-20386

The CVE-2024-20386 entry describes stored XSS in the web-based management interface of Cisco Firepower Management Center (FMC) Software due to insufficient validation of user-supplied input. An unauthenticated, remote attacker could inject crafted input into interface data fields to execute scrip...

CVE-2024-20403

CVE-2024-20403 affects Cisco Firepower Management Center (FMC) Software, specifically its web-based management interface. Root cause: insufficient validation of user-supplied input in the interface, enabling a cross-site scripting (XSS) attack. Impact: an authenticated remote attacker could execu...

CVE-2016-1457

The CVE-2016-1457 issue affects Cisco Firepower Management Center (FMC) 4.x–5.x before 5.3.1.2 and 5.4.x before 5.4.0.1, and Cisco ASA 5500-X Series with FirePOWER Services in the same ranges. A remote authenticated user can execute arbitrary root commands by sending crafted HTTP requests due to ...

CVE-2016-6365

Cisco Firepower Management Center (FMC) is affected by CVE-2016-6365, an XSS vulnerability in FMC versions 4.10.3, 5.2.0, 5.3.0, 5.3.0.2, 5.3.1, and 5.4.0. The issue stems from insufficient input validation in the web framework, allowing remote attackers to inject arbitrary web script/HTML via un...

CVE-2024-20273

Cisco Firepower Management Center (FMC) is affected by a cross-site scripting (XSS) vulnerability in the web-based management interface due to insufficient validation of user-supplied input. An unauthenticated, remote attacker could exploit crafted input in various data fields to execute arbitrar...

CVE-2024-20473

The CVE-2024-20473 entry affects Cisco Secure Firewall Management Center (FMC) web-based management interface. It describes an authenticated, remote SQL injection caused by inadequate input validation, exploitable by an Administrator to access/modify data in the FMC database. The vulnerability’s ...

CVE-2024-20269

CVE-2024-20269 affects Cisco Firepower Management Center / Cisco Secure Firewall Management Center. The web-based management interface is vulnerable to XSS due to insufficient validation of user-supplied input. An authenticated, remote attacker can inject crafted input into interface data fields ...

CVE-2019-1709

CVE-2019-1709 affects Cisco Firepower Threat Defense Software’s CLI, where insufficient input validation allows an authenticated, local attacker to perform a command injection, potentially executing commands with root privileges. The issue concerns the CLI and specific command arguments, with exp...

CVE-2024-20298

CVE-2024-20298 affects Cisco Firepower Management Center (FMC) web-based management interface. The issue is an input validation weakness that allows an authenticated, remote attacker to inject crafted input, enabling cross-site scripting (XSS) to run scripts in the interface or access browser-bas...

CVE-2025-20306

Cisco Secure Firewall Management Center (FMC) CMD injection vulnerability (CVE-2025-20306) affects the web-based management interface. An authenticated administrator can exploit insufficient input validation of HTTP request parameters to execute arbitrary commands as root on the underlying OS. Ex...

CVE-2026-20044

The CVE-2026-20044 affects Cisco Secure Firewall Management Center (FMC) Software. The issue stems from insufficient restrictions on remediation modules during lockdown mode, allowing an authenticated local attacker with admin credentials to send crafted input to the system CLI and potentially ex...

CVE-2025-20235

CVE-2025-20235 is a cross-site scripting (XSS) vulnerability in Cisco Secure Firewall Management Center (FMC) Web UI. Multiple connected sources confirm unauthenticated remote exploitation through insufficient input validation in the FMC web-based management interface, allowing arbitrary script e...

CVE-2025-20302

CVE-2025-20302 : Cisco Secure FMC Software’s web-based management interface contains a missing authorization check that could let an authenticated, low-privileged, remote attacker retrieve a generated report from a different domain managed on the same FMC instance. The attacker could directly acc...

CVE-2026-20003

Cisco Secure FMC Software’s REST API vulnerability enables authenticated remote SQL injection due to insufficient input validation. An attacker with valid credentials (Administrator, Security approver, Intrusion admin, Access admin, Network admin) could send crafted requests to read the database ...

CVE-2025-20301

CVE-2025-20301 affects Cisco Secure FMC Software’s web-based management interface. The issue arises from missing authorization checks, allowing an authenticated, low-privileged, remote attacker to directly access troubleshoot files for a different domain managed on the same FMC instance. The prac...

CVE-2025-20218

Cisco Secure Firewall Management Center (FMC) Software is affected by a vulnerability in its web-based management interface caused by insufficient input validation. An authenticated remote attacker with valid administrative credentials could send a crafted request to retrieve sensitive informatio...

CVE-2026-20002

Cisco Secure FMC Software’s web-based management interface is affected by an SQL injection due to inadequate input validation. An authenticated, remote attacker with valid credentials could craft requests to access the database and read certain OS files, with high impact to confidentiality and in...