CVE-2021-34752: Cisco Firepower Threat Defense Command Injection Vulnerabilities
First published: Fri Nov 15 2024(Updated: )
A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands with root privileges on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute commands with root privileges on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Firepower Threat Defense |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-34752?
CVE-2021-34752 has been assigned a high severity rating due to the potential for unauthorized command execution with root privileges.
Who is affected by CVE-2021-34752?
CVE-2021-34752 affects authenticated, local users with administrative privileges on Cisco Firepower Threat Defense devices.
How do I fix CVE-2021-34752?
To fix CVE-2021-34752, apply the latest security patches provided by Cisco for the affected Firepower Threat Defense software.
What are the potential consequences of CVE-2021-34752 exploitation?
Exploitation of CVE-2021-34752 could lead to full control over the affected device's operating system, allowing attackers to execute arbitrary commands.
Is CVE-2021-34752 still a risk for my environment?
The risk associated with CVE-2021-34752 persists if the recommended patches have not been applied to your Cisco Firepower Threat Defense systems.
- agent/title
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request