Cisco Secure Firewall Management Center up to 10.0.1 Web-based Management Interface sql injection

Summaryinfo

A vulnerability was found in Cisco Secure Firewall Management Center and classified as problematic. This impacts an unknown function of the component Web-based Management Interface. Executing a manipulation can lead to sql injection. This vulnerability appears as CVE-2026-20344. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Cisco Secure Firewall Management Center and classified as problematic. This vulnerability affects an unknown code of the component Web-based Management Interface. The manipulation with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of Security Approver, Access Admin, or Network Admin. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain any data from the database, obtain the session credentials of an authenticated Administrator, and take actions with administrative privileges on the affected device.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability was named CVE-2026-20344 since 10/08/2025. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are necessary for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/16/2026). The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Secure Firewall Management Center

Version

• 7.0.0
• 7.0.0.1
• 7.0.1
• 7.0.1.1
• 7.0.2
• 7.0.2.1
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.6.1
• 7.0.6.2
• 7.0.6.3
• 7.0.7
• 7.0.8
• 7.0.8.1
• 7.0.9
• 7.2.0
• 7.2.0.1
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.3.1
• 7.2.4
• 7.2.4.1
• 7.2.5
• 7.2.5.1
• 7.2.5.2
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.8.1
• 7.2.9
• 7.2.10
• 7.2.10.1
• 7.2.10.2
• 7.2.11
• 7.3.0
• 7.3.1
• 7.3.1.1
• 7.3.1.2
• 7.4.0
• 7.4.1
• 7.4.1.1
• 7.4.2
• 7.4.2.1
• 7.4.2.2
• 7.4.2.3
• 7.4.2.4
• 7.4.3
• 7.4.4
• 7.4.5
• 7.4.6
• 7.4.7
• 7.6.0
• 7.6.1
• 7.6.2
• 7.6.2.1
• 7.6.3
• 7.6.4
• 7.6.5
• 7.7.0
• 7.7.10
• 7.7.10.1
• 7.7.11
• 7.7.12
• 10.0.0
• 10.0.1

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion