CVE-2020-3253

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. The issue is due to improper configuration of the support tunnel feature. An attacker could exploit this by enabling the support tunnel, setting a key, and deriving the tunnel password, potentially allowing them to run any system command with root access on an affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.