CVE-2022-20949: Medium severity Cisco Firepower Threat Defense vulnerability

Q: What is the vulnerability ID for this Cisco Firepower Threat Defense (FTD) Software vulnerability?

The vulnerability ID is CVE-2022-20949.

Q: What is the severity of CVE-2022-20949?

The severity of CVE-2022-20949 is medium.

Q: What software is affected by CVE-2022-20949?

Cisco Firepower Threat Defense (FTD) Software versions 6.1.0 to 7.2.0 are affected.

Q: How does CVE-2022-20949 exploit work?

CVE-2022-20949 allows an authenticated, remote attacker with high privileges to execute configuration commands on an affected system by exploiting a vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software.

Q: Where can I find more information about CVE-2022-20949?

You can find more information about CVE-2022-20949 on the Cisco Security Advisory page: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-mgmt-privesc-7GqR2th

Published Nov 10, 2022

Updated

A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This vulnerability exists because access to HTTPS endpoints is not properly restricted on an affected device. An attacker could exploit this vulnerability by sending specific messages to the affected HTTPS handler. A successful exploit could allow the attacker to perform configuration changes on the affected system, which should be configured and managed only through Cisco Firepower Management Center (FMC) Software.

Affected Software

32 affected components

Cisco Firepower Threat Defense>=6.1.0<=6.1.0.7

Cisco Firepower Threat Defense>=6.2.0<=6.2.0.6

Cisco Firepower Threat Defense>=6.2.2<=6.2.2.5

Cisco Firepower Threat Defense>=6.2.3<=6.2.3.18

Cisco Firepower Threat Defense>=6.3.0<=6.3.0.5

Cisco Firepower Threat Defense>=6.4.0<=6.4.0.15

Cisco Firepower Threat Defense>=6.5.0<=6.5.0.5

Cisco Firepower Threat Defense>=6.6.0<=6.6.5.2

Cisco Firepower Threat Defense>=6.7.0<=6.7.0.3

Cisco Firepower Threat Defense>=7.0.0<=7.0.3

Cisco Firepower Threat Defense=6.2.1

Cisco Firepower Threat Defense=7.1.0.0

Cisco Firepower Threat Defense=7.1.0.1

Cisco Firepower Threat Defense=7.1.0.2

Cisco Firepower Threat Defense=7.2.0

Cisco Firepower Threat Defense=7.2.0.1

Cisco Secure Firewall Threat Defense>=6.1.0<=6.1.0.7

Cisco Secure Firewall Threat Defense>=6.2.0<=6.2.0.6

Cisco Secure Firewall Threat Defense>=6.2.2<=6.2.2.5

Cisco Secure Firewall Threat Defense>=6.2.3<=6.2.3.18

Cisco Secure Firewall Threat Defense>=6.3.0<=6.3.0.5

Cisco Secure Firewall Threat Defense>=6.4.0<=6.4.0.15

Cisco Secure Firewall Threat Defense>=6.5.0<=6.5.0.5

Cisco Secure Firewall Threat Defense>=6.6.0<=6.6.5.2

Cisco Secure Firewall Threat Defense>=6.7.0<=6.7.0.3

Cisco Secure Firewall Threat Defense>=7.0.0<=7.0.3

Cisco Secure Firewall Threat Defense=6.2.1

Cisco Secure Firewall Threat Defense=7.1.0.0

Cisco Secure Firewall Threat Defense=7.1.0.1

Cisco Secure Firewall Threat Defense=7.1.0.2

Cisco Secure Firewall Threat Defense=7.2.0

Cisco Secure Firewall Threat Defense=7.2.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Restrict access to the HTTPS endpoints on the affected device so they are not broadly reachable; ensure management web server access is configured and managed only through Cisco Firepower Management Center (FMC) Software.
Cisco Firepower Threat Defense (FTD) Software - HTTPS management endpoints HTTPS endpoint access restriction (not properly restricted)','value':
Configuration
Ensure configuration changes are configured and managed only via Cisco Firepower Management Center (FMC) Software, not directly through the FTD management web server/HTTPS handler.
Cisco Firepower Threat Defense (FTD) Software - HTTPS handler Management configuration changes = Only through Cisco Firepower Management Center (FMC) Software

Event History

Nov 10, 2022

CVE Published

via MITRE·05:32 PM

Data Sourced

via MITRE·05:32 PM

DescriptionSeverityWeakness

Nov 15, 2022

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for this Cisco Firepower Threat Defense (FTD) Software vulnerability?

The vulnerability ID is CVE-2022-20949.

What is the severity of CVE-2022-20949?

The severity of CVE-2022-20949 is medium.

What software is affected by CVE-2022-20949?

Cisco Firepower Threat Defense (FTD) Software versions 6.1.0 to 7.2.0 are affected.

How does CVE-2022-20949 exploit work?