Product:
Cisco Secure Firewall Management Center
Summary
A vulnerability in the lockdown mechanism of Cisco Secure Firewall Management Center Software could allow an authenticated, local attacker to perform arbitrary commands as root. This vulnerability is due to insufficient restrictions on remediation modules while in lockdown mode. An attacker could exploit this vulnerability by sending crafted input to the system CLI of the affected device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6 | CVE-2026-20044 |
Exploitation
To exploit this vulnerability, the attacker must have valid administrative credentials. Once authenticated, the attacker can send specially crafted input to the system CLI, which could allow them to execute arbitrary commands or code as root, even when the system is in lockdown mode.
Affected Products
- Cisco Secure Firewall Management Center: Vulnerable due to insufficient restrictions on remediation modules in lockdown mode.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Cisco. Additionally, ensure that administrative access is restricted to trusted personnel only and monitor system logs for any unauthorized access attempts.