cisco-sa-ftd-enip-bypass-eFsxd8KP: Cisco Firepower Threat Defense Software Ethernet Industrial Protocol Policy Bypass Vulnerabilities
First published: Wed Oct 27 2021(Updated: )
Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. These vulnerabilities are due to incomplete processing during deep packet inspection for ENIP packets. An attacker could exploit these vulnerabilities by sending a crafted ENIP packet to the targeted interface. A successful exploit could allow the attacker to bypass configured access control and intrusion policies that should be activated for the ENIP packet. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-enip-bypass-eFsxd8KP This advisory is part of the October 2021 release of the Cisco ASA, FTD, and FMC Security Advisory Bundled publication. For a complete list of the advisories and links to them, see Cisco Event Response: October 2021 Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication.
Credit: Gregory Norton the Naval Postgraduate School for reporting these vulnerabilitiesThuy Nguyen the Naval Postgraduate School for reporting these vulnerabilities the Naval Postgraduate School for reporting these vulnerabilitiesCynthia Irvine the Naval Postgraduate School for reporting these vulnerabilities
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco FTD Software | =6.7.0<6.7.0.3 (Jan 2022)>=6.5.0<=6.6.0<6.6.5.1 (Nov 2021)>=6.2.2 and earlier=6.2.3=6.3.0<=6.4.0<6.4.0.13 (Nov 2021) | 6.7.0.3 (Jan 2022) 6.6.5.1 (Nov 2021) 6.4.0.13 (Nov 2021) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is cisco-sa-ftd-enip-bypass-eFsxd8KP.
What is the severity of cisco-sa-ftd-enip-bypass-eFsxd8KP?
The severity of cisco-sa-ftd-enip-bypass-eFsxd8KP is medium with a CVSS score of 5.8.
Which software versions are affected by cisco-sa-ftd-enip-bypass-eFsxd8KP?
The affected software versions are Cisco FTD Software versions 6.2.2 and earlier, 6.2.3, 6.3.0, 6.4.0 up to 6.4.0.13 (Nov 2021), 6.5.0 up to 6.6.0, 6.6.5.1 (Nov 2021), and 6.7.0 up to 6.7.0.3 (Jan 2022).
How can an attacker exploit cisco-sa-ftd-enip-bypass-eFsxd8KP?
An unauthenticated, remote attacker can exploit cisco-sa-ftd-enip-bypass-eFsxd8KP to bypass configured rules for Ethernet Industrial Protocol (ENIP) traffic.
Is there a remedy for cisco-sa-ftd-enip-bypass-eFsxd8KP?
Yes, Cisco has released software updates to address the vulnerabilities. Please refer to the Cisco Security Advisory for the specific software versions and their corresponding fixes.
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- agent/title
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/tags
- agent/event
- agent/description
- vendor/cisco
- canonical/cisco ftd software
- version/cisco ftd software/6.7.0
- version/cisco ftd software/6.5.0
- version/cisco ftd software/6.6.0
- version/cisco ftd software/6.2.2 and earlier
- version/cisco ftd software/6.2.3
- version/cisco ftd software/6.3.0
- version/cisco ftd software/6.4.0