CVE-2021-1448
Assigner: cisco
Published: 2021-04-28T00:00:00
State: PUBLISHED
affected: product: Cisco Firepower Threat Defense Software 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2021-04-28T00:00:00
descriptions: value: A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device that is running in multi-instance mode. This vulnerability is due to insufficient validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input to the affected command. A successful exploit could allow the attacker to execute commands on the underlying operating system with root privileges.
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. 
metrics: cvssV3_0: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.0
problemTypes: descriptions: cweId: CWE-20
description: CWE-20
type: CWE
source: advisory: cisco-sa-ftd-cmdinj-vWY5wqZT
defect: CSCvt74832
CSCvv78677
discovery: INTERNAL
title: Cisco Firepower Threat Defense Software Command Injection Vulnerability