सिस्को सिक्योर फ़ायरवॉल मैनेजमेंट सेंटर (FMC) सॉफ्टवेयर, पूर्व में फायरपावर मैनेजमेंट सेंटर सॉफ्टवेयर के वेब-आधारित प्रबंधन इंटरफ़ेस में एक भेद्यता, एक प्रमाणित, दूरस्थ हमलावर को अनुमति दे सकती है

Successful exploitation of CVE-2024-20374 allows an attacker to gain complete control over the affected Cisco Secure Firewall Management Center. This includes the ability to install malware, steal sensitive data, modify firewall configurations, and potentially pivot to other systems on the network. The impact is particularly severe because the vulnerability requires only authenticated administrator access, a privilege often held by a limited number of personnel. A successful breach could lead to a complete compromise of the network infrastructure managed by the FMC, resulting in significant data loss, disruption of services, and reputational damage. The ability to execute arbitrary commands mirrors the impact of other high-profile RCE vulnerabilities, such as those affecting network management appliances.

Organizations heavily reliant on Cisco Secure Firewall Management Center for network security management are at significant risk. This includes large enterprises, government agencies, and managed service providers. Deployments with legacy configurations or those lacking robust access controls are particularly vulnerable. Shared hosting environments where multiple customers share a single FMC instance also face increased risk.

• linux / server:

journalctl -u firepowermgmt -f | grep -i "error" -i "exception"

• generic web:

curl -I <fmc_ip>/ui/  # Check for unusual HTTP headers or responses

• cisco: Review Cisco FMC logs for unusual HTTP requests containing suspicious parameters. Look for patterns indicative of command injection attempts. • cisco: Use Cisco's security monitoring tools to detect unauthorized access attempts to the FMC web interface. • cisco: Monitor network traffic to and from the FMC for suspicious outbound connections.

1. 2024-10-23Disclosure

   disclosure

1. आरक्षित2023-11-08
2. प्रकाशित2024-10-23
3. संशोधित2024-10-26
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-20374 is to upgrade to Cisco Secure Firewall Management Center version 7.4.2 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. Segment the FMC network to limit potential lateral movement. Review and restrict user privileges within the FMC to minimize the attack surface. Implement strict input validation on all HTTP requests to the FMC web interface, although this is complex and may not be fully effective. Monitor FMC logs for suspicious activity, particularly unusual command executions or attempts to access restricted resources. After upgrading, verify the fix by attempting to reproduce the vulnerability with a crafted HTTP request and confirming that the request is properly sanitized and rejected.