cisco-sa-20200122-fmc-auth: Cisco Firepower Management Center Lightweight Directory Access Protocol Authentication Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due to improper handling of Lightweight Directory Access Protocol (LDAP) authentication responses from an external authentication server. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to gain administrative access to the web-based management interface of the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-fmc-auth
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20200122-fmc-auth?
The cisco-sa-20200122-fmc-auth vulnerability is rated as critical due to its potential for unauthorized access and administrative control.
How do I fix cisco-sa-20200122-fmc-auth?
To fix cisco-sa-20200122-fmc-auth, upgrade your Cisco Firepower Management Center software to a version that is not affected by the vulnerability.
Which versions of Cisco FMC are affected by cisco-sa-20200122-fmc-auth?
Affected versions of Cisco FMC include versions prior to 6.4.0, and specific versions like 6.3.0 and 6.2.3.16.
Can exploitation of cisco-sa-20200122-fmc-auth be detected?
Detection of cisco-sa-20200122-fmc-auth exploitation may be challenging due to the unauthorized access and actions occurring without authentication.
What actions can an attacker perform through cisco-sa-20200122-fmc-auth?
An attacker can execute arbitrary actions with administrative privileges on the affected device due to the bypassed authentication.