5.9
CVE-2026-20018
- EPSS 0.05%
- Veröffentlicht 04.03.2026 17:39:46
- Zuletzt bearbeitet 05.03.2026 19:39:11
- Quelle psirt@cisco.com
- CVE-Watchlists
- Unerledigt
Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal Vulnerability
A vulnerability in the sftunnel functionality of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrative privileges to write arbitrary files as root on the underlying operating system. This vulnerability is due to insufficient validation of the directory path during file synchronization. An attacker could exploit this vulnerability by crafting a directory path outside of the expected file location. A successful exploit could allow the attacker to create or replace any file on the underlying operating system.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt
Cisco Secure Firewall Management Center (FMC)
Default Statusunknown
Version
7.0.0
Status
affected
Version
7.0.0.1
Status
affected
Version
7.0.1
Status
affected
Version
7.1.0
Status
affected
Version
7.0.1.1
Status
affected
Version
7.1.0.1
Status
affected
Version
7.0.2
Status
affected
Version
7.2.0
Status
affected
Version
7.0.2.1
Status
affected
Version
7.0.3
Status
affected
Version
7.1.0.2
Status
affected
Version
7.2.0.1
Status
affected
Version
7.0.4
Status
affected
Version
7.2.1
Status
affected
Version
7.0.5
Status
affected
Version
7.3.0
Status
affected
Version
7.2.2
Status
affected
Version
7.3.1
Status
affected
Version
7.2.3
Status
affected
Version
7.1.0.3
Status
affected
Version
7.2.3.1
Status
affected
Version
7.2.4
Status
affected
Version
7.0.6
Status
affected
Version
7.2.4.1
Status
affected
Version
7.2.5
Status
affected
Version
7.3.1.1
Status
affected
Version
7.4.0
Status
affected
Version
7.0.6.1
Status
affected
Version
7.2.5.1
Status
affected
Version
7.4.1
Status
affected
Version
7.2.6
Status
affected
Version
7.4.1.1
Status
affected
Version
7.0.6.2
Status
affected
Version
7.2.7
Status
affected
Version
7.2.5.2
Status
affected
Version
7.3.1.2
Status
affected
Version
7.2.8
Status
affected
Version
7.6.0
Status
affected
Version
7.4.2
Status
affected
Version
7.2.8.1
Status
affected
Version
7.0.6.3
Status
affected
Version
7.4.2.1
Status
affected
Version
7.2.9
Status
affected
Version
7.0.7
Status
affected
Version
7.7.0
Status
affected
Version
7.4.2.2
Status
affected
Version
7.2.10
Status
affected
Version
7.6.1
Status
affected
Version
7.4.2.3
Status
affected
Version
7.0.8
Status
affected
Version
7.6.2
Status
affected
Version
7.7.10
Status
affected
Version
7.2.10.1
Status
affected
Version
7.0.8.1
Status
affected
Version
7.6.2.1
Status
affected
Version
7.2.10.2
Status
affected
Version
7.7.10.1
Status
affected
Version
7.4.2.4
Status
affected
Version
7.4.3
Status
affected
HerstellerCisco
≫
Produkt
Cisco Secure Firewall Threat Defense (FTD) Software
Default Statusunknown
Version
7.0.0
Status
affected
Version
7.0.0.1
Status
affected
Version
7.0.1
Status
affected
Version
7.1.0
Status
affected
Version
7.0.1.1
Status
affected
Version
7.1.0.1
Status
affected
Version
7.0.2
Status
affected
Version
7.2.0
Status
affected
Version
7.0.2.1
Status
affected
Version
7.0.3
Status
affected
Version
7.1.0.2
Status
affected
Version
7.2.0.1
Status
affected
Version
7.0.4
Status
affected
Version
7.2.1
Status
affected
Version
7.0.5
Status
affected
Version
7.3.0
Status
affected
Version
7.2.2
Status
affected
Version
7.2.3
Status
affected
Version
7.3.1
Status
affected
Version
7.1.0.3
Status
affected
Version
7.2.4
Status
affected
Version
7.0.6
Status
affected
Version
7.2.5
Status
affected
Version
7.2.4.1
Status
affected
Version
7.3.1.1
Status
affected
Version
7.4.0
Status
affected
Version
7.0.6.1
Status
affected
Version
7.2.5.1
Status
affected
Version
7.4.1
Status
affected
Version
7.2.6
Status
affected
Version
7.0.6.2
Status
affected
Version
7.4.1.1
Status
affected
Version
7.2.7
Status
affected
Version
7.2.5.2
Status
affected
Version
7.3.1.2
Status
affected
Version
7.2.8
Status
affected
Version
7.6.0
Status
affected
Version
7.4.2
Status
affected
Version
7.2.8.1
Status
affected
Version
7.0.6.3
Status
affected
Version
7.4.2.1
Status
affected
Version
7.2.9
Status
affected
Version
7.0.7
Status
affected
Version
7.7.0
Status
affected
Version
7.4.2.2
Status
affected
Version
7.2.10
Status
affected
Version
7.6.1
Status
affected
Version
7.4.2.3
Status
affected
Version
7.0.8
Status
affected
Version
7.6.2
Status
affected
Version
7.7.10
Status
affected
Version
7.0.8.1
Status
affected
Version
7.6.2.1
Status
affected
Version
7.7.10.1
Status
affected
Version
7.4.2.4
Status
affected
Version
7.2.10.2
Status
affected
Version
7.4.3
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.05% | 0.166 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| psirt@cisco.com | 5.9 | 0.7 | 5.2 |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
|
CWE-27 Path Traversal: 'dir/../../filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.