Product:
Cisco Secure FMC Software
Summary
A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.1 | CVE-2026-20002 |
Exploitation
To exploit this vulnerability, the attacker would need valid user credentials. Once authenticated, the attacker can send specially crafted requests to the web-based management interface, which could lead to SQL injection. A successful exploit could allow the attacker to gain full access to the database and read sensitive files on the underlying operating system.
Affected Products
- Cisco Secure FMC Software: Vulnerable due to inadequate validation of user input in the web-based management interface.
Mitigation
To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization measures. Additionally, ensure that only authorized users have access to the web-based management interface and regularly update the software to the latest version to address any security flaws.