Product:
Cisco Secure Firewall
Summary
A vulnerability in a small subset of CLI commands used on Cisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software could allow an authenticated, local attacker to craft Lua code that could be executed as root. This vulnerability exists due to improper sanitization of user-provided input. A successful exploit could lead to arbitrary code execution as the root user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6 | CVE-2026-20008 |
Exploitation
To exploit this vulnerability, an attacker must have valid Administrator credentials. The attacker can craft valid Lua code and submit it as a malicious parameter for a CLI command. If successful, this could allow the attacker to inject Lua code into the underlying operating system, leading to arbitrary code execution.
Affected Products
- Cisco Secure Firewall Adaptive Security Appliance Software: Affected by the vulnerability due to improper input sanitization in CLI commands.
- Cisco Secure Firewall Threat Defense Software: Also vulnerable as it shares the same CLI command issues.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that all user inputs are properly sanitized and validated. Additionally, restricting access to CLI commands and monitoring for unusual activity can help prevent exploitation.