Vulnerabilities > CVE-2021-34761 - Exposure of Resource to Wrong Sphere vulnerability in Cisco products

CVSS 6.0 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

cisco

CWE-668

NVD

Published: 2021-10-27

Updated: 2023-11-07

Summary

A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The attacker must have administrative credentials on the device. This vulnerability is due to incomplete validation of user input for a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device with administrative privileges and issuing a CLI command with crafted user parameters. A successful exploit could allow the attacker to overwrite or append arbitrary data to system files using root-level privileges.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco Firepower Management Center Virtual Appliance 6.2.3 Cisco Firepower Management Center Virtual Appliance 7.1.0 Cisco Firepower Management Center Virtual Appliance 6.4.0 Cisco Firepower Management Center Virtual Appliance 6.6.1 Cisco Firepower Management Center Virtual Appliance 6.7.0 Cisco Firepower Management Center Virtual Appliance 7.0.0 Cisco Sourcefire Defense Center 6.4.0 Cisco Sourcefire Defense Center 6.2.3 Cisco Sourcefire Defense Center 7.1.0 Cisco Sourcefire Defense Center 6.6.1 Cisco Sourcefire Defense Center 6.7.0 Cisco Sourcefire Defense Center 7.0.0 Cisco Firepower Threat Defense 7.0.0 Cisco Firepower Threat Defense 7.0.0.1 Cisco Firepower Threat Defense 6.7.0 Cisco Firepower Threat Defense 6.7.0.1 Cisco Firepower Threat Defense 6.7.0.2 Cisco Firepower Threat Defense 6.7.0.3 Cisco Firepower Threat Defense 6.4.0 Cisco Firepower Threat Defense 6.4.0.1 Cisco Firepower Threat Defense 6.4.0.2 Cisco Firepower Threat Defense 6.4.0.3 Cisco Firepower Threat Defense 6.4.0.4 Cisco Firepower Threat Defense 6.4.0.5 Cisco Firepower Threat Defense 6.4.0.6 Cisco Firepower Threat Defense 6.4.0.7 Cisco Firepower Threat Defense 6.4.0.8 Cisco Firepower Threat Defense 6.4.0.9 Cisco Firepower Threat Defense 6.4.0.10 Cisco Firepower Threat Defense 6.4.0.11 Cisco Firepower Threat Defense 6.4.0.12 Cisco Firepower Threat Defense 6.6.0 Cisco Firepower Threat Defense 6.6.0.1 Cisco Firepower Threat Defense 6.6.1 Cisco Firepower Threat Defense 6.6.3 Cisco Firepower Threat Defense 6.6.4	36

Common Weakness Enumeration (CWE)

CWE-668 - Exposure of Resource to Wrong Sphere

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-file-write-SHVcmQVc