A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthenticated, local attacker to access an affected system using static credentials.
This vulnerability is due to the presence of static accounts with hard-coded passwords on an affected system. An attacker could exploit this vulnerability by logging in to the CLI of an affected device with these credentials. A successful exploit could allow the attacker to access the affected system and retrieve sensitive information, perform limited troubleshooting actions, modify some configuration options, or render the device unable to boot to the operating system, requiring a reimage of the device.
References
| Link | Resource |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-statcred-dFC8tXT5 | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
05 Nov 2024, 15:03
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Cisco firepower 1120
Cisco firepower 2120 Cisco firepower 3130 Cisco firepower 1010 Cisco firepower 2140 Cisco firepower 1150 Cisco firepower 2100 Cisco firepower 1030 Cisco firepower 3105 Cisco firepower 1000 Cisco firepower 4245 Cisco firepower 3140 Cisco firepower 2130 Cisco Cisco firepower 1040 Cisco firepower 3120 Cisco firepower 2110 Cisco firepower 3110 Cisco firepower 1140 Cisco firepower 4225 Cisco firepower 4215 Cisco firepower 1020 Cisco firepower Threat Defense |
|
| References | () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-statcred-dFC8tXT5 - Vendor Advisory | |
| CWE | CWE-798 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.4 |
| CPE | cpe:2.3:a:cisco:firepower_threat_defense:7.2.3:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_1040:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_4225:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.6:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_3110:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.1:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_4215:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_1120:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.4.0:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_2100:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.7:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.3.1.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.4.1:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_1030:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.5:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.4.1:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_4245:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_3130:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_1000:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_1020:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.3:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.3.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.3.1.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.4.1.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_3140:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.5.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.4:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_3120:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_1150:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.5.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.2.0.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.3.1:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_3105:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.2:*:*:*:*:*:*:* cpe:2.3:h:cisco:firepower_1140:-:*:*:*:*:*:*:* |
23 Oct 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-23 18:15
Updated : 2024-11-05 15:03
NVD link : CVE-2024-20412
Mitre link : CVE-2024-20412
JSON object : View
Products Affected
cisco
- firepower_2140
- firepower_3105
- firepower_1030
- firepower_1120
- firepower_threat_defense
- firepower_1020
- firepower_2110
- firepower_1140
- firepower_1000
- firepower_4225
- firepower_1040
- firepower_1010
- firepower_2130
- firepower_3130
- firepower_3140
- firepower_2100
- firepower_4245
- firepower_3110
- firepower_1150
- firepower_2120
- firepower_3120
- firepower_4215
CWE
CWE-798
Use of Hard-coded Credentials