5.9
CVE-2026-20018
- EPSS 0.19%
- Veröffentlicht 04.03.2026 17:39:46
- Zuletzt bearbeitet 05.03.2026 19:39:11
- Quelle psirt@cisco.com
- CVE-Watchlists
- Unerledigt
A vulnerability in the sftunnel functionality of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrative privileges to write arbitrary files as root on the underlying operating system. This vulnerability is due to insufficient validation of the directory path during file synchronization. An attacker could exploit this vulnerability by crafting a directory path outside of the expected file location. A successful exploit could allow the attacker to create or replace any file on the underlying operating system.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
LoginDaten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt
Cisco Secure Firewall Management Center (FMC)
Default Statusunknown
Version
7.0.0
Status
affected
Version
7.0.0.1
Status
affected
Version
7.0.1
Status
affected
Version
7.1.0
Status
affected
Version
7.0.1.1
Status
affected
Version
7.1.0.1
Status
affected
Version
7.0.2
Status
affected
Version
7.2.0
Status
affected
Version
7.0.2.1
Status
affected
Version
7.0.3
Status
affected
Version
7.1.0.2
Status
affected
Version
7.2.0.1
Status
affected
Version
7.0.4
Status
affected
Version
7.2.1
Status
affected
Version
7.0.5
Status
affected
Version
7.3.0
Status
affected
Version
7.2.2
Status
affected
Version
7.3.1
Status
affected
Version
7.2.3
Status
affected
Version
7.1.0.3
Status
affected
Version
7.2.3.1
Status
affected
Version
7.2.4
Status
affected
Version
7.0.6
Status
affected
Version
7.2.4.1
Status
affected
Version
7.2.5
Status
affected
Version
7.3.1.1
Status
affected
Version
7.4.0
Status
affected
Version
7.0.6.1
Status
affected
Version
7.2.5.1
Status
affected
Version
7.4.1
Status
affected
Version
7.2.6
Status
affected
Version
7.4.1.1
Status
affected
Version
7.0.6.2
Status
affected
Version
7.2.7
Status
affected
Version
7.2.5.2
Status
affected
Version
7.3.1.2
Status
affected
Version
7.2.8
Status
affected
Version
7.6.0
Status
affected
Version
7.4.2
Status
affected
Version
7.2.8.1
Status
affected
Version
7.0.6.3
Status
affected
Version
7.4.2.1
Status
affected
Version
7.2.9
Status
affected
Version
7.0.7
Status
affected
Version
7.7.0
Status
affected
Version
7.4.2.2
Status
affected
Version
7.2.10
Status
affected
Version
7.6.1
Status
affected
Version
7.4.2.3
Status
affected
Version
7.0.8
Status
affected
Version
7.6.2
Status
affected
Version
7.7.10
Status
affected
Version
7.2.10.1
Status
affected
Version
7.0.8.1
Status
affected
Version
7.6.2.1
Status
affected
Version
7.2.10.2
Status
affected
Version
7.7.10.1
Status
affected
Version
7.4.2.4
Status
affected
Version
7.4.3
Status
affected
HerstellerCisco
≫
Produkt
Cisco Secure Firewall Threat Defense (FTD) Software
Default Statusunknown
Version
7.0.0
Status
affected
Version
7.0.0.1
Status
affected
Version
7.0.1
Status
affected
Version
7.1.0
Status
affected
Version
7.0.1.1
Status
affected
Version
7.1.0.1
Status
affected
Version
7.0.2
Status
affected
Version
7.2.0
Status
affected
Version
7.0.2.1
Status
affected
Version
7.0.3
Status
affected
Version
7.1.0.2
Status
affected
Version
7.2.0.1
Status
affected
Version
7.0.4
Status
affected
Version
7.2.1
Status
affected
Version
7.0.5
Status
affected
Version
7.3.0
Status
affected
Version
7.2.2
Status
affected
Version
7.2.3
Status
affected
Version
7.3.1
Status
affected
Version
7.1.0.3
Status
affected
Version
7.2.4
Status
affected
Version
7.0.6
Status
affected
Version
7.2.5
Status
affected
Version
7.2.4.1
Status
affected
Version
7.3.1.1
Status
affected
Version
7.4.0
Status
affected
Version
7.0.6.1
Status
affected
Version
7.2.5.1
Status
affected
Version
7.4.1
Status
affected
Version
7.2.6
Status
affected
Version
7.0.6.2
Status
affected
Version
7.4.1.1
Status
affected
Version
7.2.7
Status
affected
Version
7.2.5.2
Status
affected
Version
7.3.1.2
Status
affected
Version
7.2.8
Status
affected
Version
7.6.0
Status
affected
Version
7.4.2
Status
affected
Version
7.2.8.1
Status
affected
Version
7.0.6.3
Status
affected
Version
7.4.2.1
Status
affected
Version
7.2.9
Status
affected
Version
7.0.7
Status
affected
Version
7.7.0
Status
affected
Version
7.4.2.2
Status
affected
Version
7.2.10
Status
affected
Version
7.6.1
Status
affected
Version
7.4.2.3
Status
affected
Version
7.0.8
Status
affected
Version
7.6.2
Status
affected
Version
7.7.10
Status
affected
Version
7.0.8.1
Status
affected
Version
7.6.2.1
Status
affected
Version
7.7.10.1
Status
affected
Version
7.4.2.4
Status
affected
Version
7.2.10.2
Status
affected
Version
7.4.3
Status
affected
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.19% | 0.402 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| psirt@cisco.com | 5.9 | 0.7 | 5.2 |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
|
CWE-27 Path Traversal: 'dir/../../filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.