Filtering bypass in Cisco Secure Firewall Management Center (formerly Firepower Management Center, FMC) - CVE-2017-6674
Published: May 25, 2017
Vulnerability identifier: #VU6718
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-6674
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to bypass URL filters on the target system.
The weakness exists in the feature-license management functionality of Cisco Firepower System Software due to insufficient validation of user-supplied input. A remote attacker can send traffic matching a configured URL filter and bypass URL filters to access certain websites.
Successful exploitation of the vulnerability results in access to the website.
The weakness exists in the feature-license management functionality of Cisco Firepower System Software due to insufficient validation of user-supplied input. A remote attacker can send traffic matching a configured URL filter and bypass URL filters to access certain websites.
Successful exploitation of the vulnerability results in access to the website.
Affected software
Cisco Secure Firewall Management Center (formerly Firepower Management Center, FMC)
How to mitigate CVE-2017-6674
Update to version 6.1.0.2, 6.2.1, 6.2.0.1.