CVE-2021-1126: Cisco Firepower Management Center Information Disclosure Vulnerability
First published: Wed Jan 13 2021(Updated: )
A vulnerability in the storage of proxy server credentials of Cisco Firepower Management Center (FMC) could allow an authenticated, local attacker to view credentials for a configured proxy server. The vulnerability is due to clear-text storage and weak permissions of related configuration files. An attacker could exploit this vulnerability by accessing the CLI of the affected software and viewing the contents of the affected files. A successful exploit could allow the attacker to view the credentials that are used to access the proxy server.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Secure Firewall Management Center | <6.7.0 | |
| Cisco Firepower Management Center (FMC) and Firepower Threat Defense (FTD) Software | <6.7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-1126?
CVE-2021-1126 is rated as a medium severity vulnerability.
How do I fix CVE-2021-1126?
To fix CVE-2021-1126, ensure that you upgrade to a version of Cisco Firepower Management Center that is more recent than 6.7.0.
Who is affected by CVE-2021-1126?
CVE-2021-1126 affects users of Cisco Secure Firewall Management Center and Cisco Firepower Management Center Software versions up to 6.7.0.
What causes CVE-2021-1126?
CVE-2021-1126 is caused by the clear-text storage of proxy server credentials coupled with weak permissions on associated configuration files.
Can CVE-2021-1126 be exploited remotely?
CVE-2021-1126 requires authenticated local access for exploitation, meaning it cannot be exploited remotely.
- agent/type
- agent/references
- agent/weakness
- agent/title
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco secure firewall management center
- canonical/cisco firepower management center (fmc) and firepower threat defense (ftd) software