CVE-2022-20926
Severity CVSS v4.0:
Pending analysis
Type:
CWE-77
Command Injection
Publication date:
15/11/2022
Last modified:
26/11/2024
Description
A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system.<br />
<br />
The vulnerability is due to insufficient validation of user-supplied parameters for certain API endpoints. An attacker could exploit this vulnerability by sending crafted input to an affected API endpoint. A successful exploit could allow an attacker to execute arbitrary commands on the device with low system privileges. To successfully exploit this vulnerability, an attacker would need valid credentials for a user with Device permissions: by default, only Administrators, Security Approvers and Network Admins user accounts have these permissions.
Impact
Base Score 3.x
6.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:cisco:secure_firewall_management_center:7.0.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:cisco:secure_firewall_management_center:7.0.4:*:*:*:*:*:*:* | ||
| cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.2:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page