CVE-2021-34761 Cisco Firepower Threat Defense Software CLI Arbitrary File Write Vulnerability
Authenticated local attackers with admin credentials can overwrite system files via CLI input validation flaws, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34761?
CVE-2021-34761 is a medium-severity path traversal vulnerability in Cisco Secure Firewall Threat Defense, published on 27 Oct 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The attacker must have administrative credentials on the device. This vulnerability is due to incomplete validation of user input for a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device with administrative privileges and issuing a CLI command with crafted user parameters. A successful exploit could allow the attacker to overwrite or append arbitrary data to system files using root-level privileges.
Which versions are affected by CVE-2021-34761?
It affects 3 products.
Products include Cisco Firepower Management Center Virtual Appliance, Cisco Secure Firewall Threat Defense, Cisco Sourcefire Defense Center.
How do I fix CVE-2021-34761?
No fix has been published for CVE-2021-34761 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-34761 being exploited?
There is no known exploitation of CVE-2021-34761 in the wild and no public exploit code.
Other vulnerabilities in Cisco Secure Firewall Threat Defense
- CVE-2021-34781 Cisco Firepower Threat Defense Software SSH Connections Denial of Service Vulnerability
- CVE-2021-34762 Cisco Firepower Management Center Software Authenticated Directory Traversal Vulnerability
- CVE-2021-34755 Cisco Firepower Threat Defense Software Command Injection Vulnerabilities
- CVE-2021-34756 Cisco Firepower Threat Defense Software Command Injection Vulnerabilities
- CVE-2021-34763 Cisco Firepower Management Center Software Cross-Site Scripting and Open Redirect Vulnerabilities
Sources
Also known as GHSA-3vcw-92x2-jjg4.