Vulnerability Description
A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The attacker must have administrative credentials on the device. This vulnerability is due to incomplete validation of user input for a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device with administrative privileges and issuing a CLI command with crafted user parameters. A successful exploit could allow the attacker to overwrite or append arbitrary data to system files using root-level privileges.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Firepower Management Center Virtual Appliance | 6.2.3 |
| Cisco | Firepower Threat Defense | >= 6.4.0, < 6.4.0.13 |
| Cisco | Sourcefire Defense Center | 6.2.3 |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fVendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fVendor Advisory
FAQ
What is CVE-2021-34761?
CVE-2021-34761 is a vulnerability with a CVSS score of 4.4 (MEDIUM). A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The att...
How severe is CVE-2021-34761?
CVE-2021-34761 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-34761?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Firepower Management Center Virtual Appliance, Cisco Firepower Threat Defense, Cisco Sourcefire Defense Center.