Cisco Secure Firewall Management Center Command Injection Vulnerability in Lockdown Mode

A command injection vulnerability has been identified in Cisco Secure Firewall Management Center (FMC) Software. This issue allows an authenticated, local attacker to execute arbitrary commands with root privileges. The vulnerability arises from inadequate restrictions on remediation modules during lockdown mode, which is disabled by default. An attacker with valid administrative credentials could exploit this by sending crafted input to the system CLI. When lockdown mode is off, root-level access is readily available through the expert CLI command.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution as root, bypassing lockdown mode restrictions.

Remediation

Cisco has released software updates to address this vulnerability. For guidance on upgrading, consult the Cisco Security Vulnerability Policy and use the Cisco Software Checker tool to identify the first fixed release.