A vulnerability, which was classified as critical, has been found in Cisco FirePOWER Management Center (Firewall Software) (affected version unknown). Affected by this issue is an unknown functionality of the component Web UI. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to execute arbitrary commands within the affected device.

The weakness was published 10/02/2019 as cisco-sa-20191002-fmc-rce as confirmed advisory (Website). The advisory is available at tools.cisco.com. This vulnerability is handled as CVE-2019-12688 since 06/04/2019. The attack may be launched remotely. The successful exploitation needs a simple authentication. The technical details are unknown and an exploit is not available.

Upgrading eliminates this vulnerability.

Similar entry is available at VDB-142849.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• FirePOWER Management Center

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion