CVE-2024-20361
First published: Wed May 22 2024(Updated: )
A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass configured access controls on managed devices that are running Cisco Firepower Threat Defense (FTD) Software. This vulnerability is due to the incorrect deployment of the Object Groups for ACLs feature from Cisco FMC Software to managed FTD devices in high-availability setups. After an affected device is rebooted following Object Groups for ACLs deployment, an attacker can exploit this vulnerability by sending traffic through the affected device. A successful exploit could allow the attacker to bypass configured access controls and successfully send traffic to devices that are expected to be protected by the affected device.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Firepower Management Center Software | ||
| Cisco Firepower Management Center (FMC) and Firepower Threat Defense (FTD) Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20361?
CVE-2024-20361 has been assigned a high severity rating due to its potential to allow unauthenticated remote access control bypass.
How do I fix CVE-2024-20361?
To fix CVE-2024-20361, upgrade to the latest version of Cisco Firepower Management Center and Firepower Threat Defense Software as recommended by Cisco.
Which products are affected by CVE-2024-20361?
CVE-2024-20361 affects Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software.
Can CVE-2024-20361 be exploited remotely?
Yes, CVE-2024-20361 can be exploited by an unauthenticated remote attacker.
What impact does CVE-2024-20361 have on network security?
CVE-2024-20361 allows attackers to bypass access controls, significantly compromising the security of managed devices.
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco firepower management center software
- canonical/cisco firepower management center (fmc) and firepower threat defense (ftd) software