CVE-2020-3549: Cisco Firepower Management Center Software and Firepower Threat Defense Software sftunnel Pass the Hash Vulnerability
First published: Wed Oct 21 2020(Updated: )
A vulnerability in the sftunnel functionality of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to obtain the device registration hash. The vulnerability is due to insufficient sftunnel negotiation protection during initial device registration. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a specific flow of the sftunnel communication between an FMC device and an FTD device. A successful exploit could allow the attacker to decrypt and modify the sftunnel communication between FMC and FTD devices, allowing the attacker to modify configuration data sent from an FMC device to an FTD device or alert data sent from an FTD device to an FMC device.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Firepower Threat Defense | <6.6.1 | |
| Cisco Secure Firewall Management Center | <6.6.1 | |
| Cisco Firepower Management Center Software | <6.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-3549?
CVE-2020-3549 has a medium severity rating due to the potential for unauthorized access to device registration hashes.
How do I fix CVE-2020-3549?
To fix CVE-2020-3549, upgrade Cisco Firepower Management Center and Firepower Threat Defense Software to at least version 6.6.1.
Who is affected by CVE-2020-3549?
CVE-2020-3549 affects users of Cisco Firepower Management Center, Firepower Threat Defense, and Secure Firewall Management Center running versions prior to 6.6.1.
What kind of attacker can exploit CVE-2020-3549?
CVE-2020-3549 can be exploited by an unauthenticated remote attacker.
What kind of information can be exposed due to CVE-2020-3549?
CVE-2020-3549 can potentially expose the device registration hash, which may aid in further attacks.
- agent/type
- agent/severity
- agent/title
- agent/references
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/event
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco firepower threat defense
- canonical/cisco secure firewall management center
- canonical/cisco firepower management center software