CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2020-3308 – Cisco Firepower Threat Defense Software Signature Verification Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-3308
A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image. Una vulnerabilidad en la funcionalidad Image Signature Verification del Cisco Firepower Threat Defense (FTD) Software, podría permitir a un atacante remoto autenticado con credenciales de nivel de administrador instalar un parche de software malicioso sobre un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sigbypass-FcvPPCeP • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-3307 – Cisco Firepower Management Center Arbitrary Log File Write Vulnerability
https://notcve.org/view.php?id=CVE-2020-3307
A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to write arbitrary entries to the log file on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send incorrect information to the system log on the affected system. Una vulnerabilidad en la Interfaz de Usuario web del Cisco Firepower Management Center (FMC) Software, podría permitir a un atacante remoto no autenticado escribir entradas arbitrarias en el archivo de registro sobre un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-alfo-tHwFDmTE • CWE-20: Improper Input Validation •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-3302 – Cisco Firepower Management Center File Overwrite Vulnerability
https://notcve.org/view.php?id=CVE-2020-3302
A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to overwrite files on the file system of an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by uploading a crafted file to the web UI on an affected device. A successful exploit could allow the attacker to overwrite files on the file system of the affected device. Una vulnerabilidad en la Interfaz de Usuario web del Cisco Firepower Management Center (FMC) Software, podría permitir a un atacante remoto autenticado sobrescribir archivos en el sistema de archivos de un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcai-z5dQObVN • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 13EXPL: 0CVE-2020-3301 – Cisco Firepower Management Center Static Credential Vulnerabilities
https://notcve.org/view.php?id=CVE-2020-3301
Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensitive part of an affected system with a high-privileged account. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en el Cisco Firepower Management Center (FMC) Software y el Cisco Firepower User Agent Software, podrían permitir a un atacante acceder a una parte confidencial de un sistema afectado con una cuenta muy privilegiada. Para más información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcua-statcred-weeCcZct • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2020-3318 – Cisco Firepower Management Center Static Credential Vulnerabilities
https://notcve.org/view.php?id=CVE-2020-3318
Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensitive part of an affected system with a high-privileged account. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en el Cisco Firepower Management Center (FMC) Software y Cisco Firepower User Agent Software, podrían permitir a un atacante acceder a una parte confidencial de un sistema afectado con una cuenta muy privilegiada. Para más información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcua-statcred-weeCcZct • CWE-798: Use of Hard-coded Credentials •