CVE-2019-12690CWE-78

Cisco Firepower Management Center Command Injection Vulnerability

High · published October 2, 2019

CVSS v3.0
7.2
EPSS
4%
Percentile
89.1
In the wild
Unconfirmed
What it is

A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to inject arbitrary commands that are executed with the privileges of the root user of the underlying operating system. The vulnerability is due to insufficient validation of user-supplied input to the web UI. An attacker could exploit this vulnerability by submitting crafted input in the web UI. A successful exploit could allow an attacker to execute arbitrary commands on the device with full root privileges.

The record
Technical detail
CVSS v3.0
7.2 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03507 · 89.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2019-10-02T19:06Z
EPSS history
Timeline
  • 02 OCT 19:06Z
    Cisco Firepower Management Center Command Injection Vulnerability
    cvelistv5