Cisco Secure Firewall Management Center Software RADIUS Remote Code Execution Vulnerability

TL;DR 📌

A critical vulnerability has been identified in the Cisco Secure Firewall Management Center (FMC) Software that allows unauthenticated remote code execution via the RADIUS subsystem. This vulnerability has a CVSS score of 10.0, indicating a severe risk. Immediate action is required to patch affected systems.

What happened 🕵️‍♂️

A vulnerability in the RADIUS subsystem of Cisco Secure FMC Software could allow an unauthenticated, remote attacker to execute arbitrary shell commands on the device. This issue arises from improper handling of user input during the authentication phase. Exploitation requires that RADIUS authentication is configured for the web-based management interface, SSH management, or both.

Affected products 🖥️

The vulnerability affects Cisco Secure FMC Software releases 7.0.7 and 7.7.0 if RADIUS authentication is enabled.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no effective workarounds for this vulnerability. However, organizations can mitigate risk by using alternative authentication methods, such as local user accounts, external LDAP authentication, or SAML single sign-on (SSO). It is crucial to evaluate the applicability and impact of these alternatives in your environment.

Risk in context 🎯

Given the critical nature of this vulnerability (CVSS 10.0), the risk is high, especially for organizations using RADIUS authentication. An attacker could gain complete control over affected devices, leading to potential data breaches or service disruptions.

Fast facts ⚡

• Vulnerability: RADIUS Remote Code Execution
• CVSS Score: 10.0 (Critical)
• Affected Software: Cisco Secure FMC Software 7.0.7 and 7.7.0 with RADIUS enabled
• Exploitation: Requires RADIUS authentication configuration
• Workarounds: None available; alternative authentication methods recommended

For leadership 🧭

The recent vulnerability in Cisco Secure Firewall Management Center Software poses a Critical risk (CVSS 10.0). It allows unauthenticated remote code execution, which could lead to severe operational impacts, including unauthorized access and control over network devices. The exposure is significant if RADIUS authentication is enabled, as exploitation can occur without user authentication.

Remediation ask: Patch affected systems within 7 days to mitigate risks.

Operational impact: Expect a brief maintenance window with no configuration drift anticipated.

Clear Now / Next / Later:

• Now: Identify and assess systems running affected software versions.
• Next: Apply the necessary patches as soon as they are available.
• Later: Review and consider alternative authentication methods to enhance security posture.

Immediate action is essential to protect your network from potential exploitation.