CVE-2021-34762

Q: What is the severity of CVE-2021-34762?

CVE-2021-34762 has a CVSS score of 8.1 (HIGH). This vulnerability allows authenticated attackers to perform directory traversal attacks on Cisco Firepower Management Center (FMC) Software via the web management interface. Attackers can read or write arbitrary files on affected devices. Only users with valid credentials can exploit this vulnerability.

8.1 HIGH

📋 TL;DR

This vulnerability allows authenticated attackers to perform directory traversal attacks on Cisco Firepower Management Center (FMC) Software via the web management interface. Attackers can read or write arbitrary files on affected devices. Only users with valid credentials can exploit this vulnerability.

💻 Affected Systems

Products:

Cisco Firepower Management Center (FMC) Software

Versions: Versions prior to 6.6.5.2, 6.7.0.2, 7.0.0

Operating Systems: Cisco FMC appliance OS

Default Config Vulnerable: ⚠️ Yes

Notes: Requires web management interface access and valid authentication credentials.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise through arbitrary file write leading to remote code execution, configuration tampering, or credential theft.

🟠

Likely Case

Unauthorized file access leading to sensitive information disclosure, configuration modification, or privilege escalation.

🟢

If Mitigated

Limited impact due to network segmentation, strong authentication controls, and monitoring preventing successful exploitation.

🌐 Internet-Facing: HIGH - Web management interfaces exposed to internet are prime targets for credential-based attacks.

🏢 Internal Only: MEDIUM - Internal attackers with valid credentials could exploit, but requires network access and authentication.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Simple directory traversal sequences in HTTPS requests.

Exploitation requires valid credentials and access to the web interface.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 6.6.5.2, 6.7.0.2, 7.0.0 or later

Vendor Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-dir-traversal-95UyW5tk

Restart Required: Yes

Instructions:

1. Backup current configuration. 2. Download appropriate patch from Cisco Software Center. 3. Apply patch via FMC web interface or CLI. 4. Restart FMC services as prompted.

🔧 Temporary Workarounds

Restrict Web Interface Access

all

Limit access to FMC web interface to trusted IP addresses only.

Configure firewall rules to restrict access to FMC management IP/ports

Enforce Strong Authentication

all

Implement multi-factor authentication and strong password policies for FMC accounts.

Configure TACACS+/RADIUS with MFA for FMC authentication

🧯 If You Can't Patch

Implement strict network segmentation to isolate FMC from untrusted networks
Enable comprehensive logging and monitoring for directory traversal attempts

🔍 How to Verify

Check if Vulnerable:

Check FMC version via web interface (System > Updates > Version) or CLI command 'show version'

Check Version:

show version | include Version

Verify Fix Applied:

Verify version is 6.6.5.2, 6.7.0.2, 7.0.0 or later and test directory traversal attempts are blocked

📡 Detection & Monitoring

Log Indicators:

HTTP requests containing '../' sequences
Unauthorized file access attempts in system logs
Authentication logs showing credential use from unusual locations

Network Indicators:

HTTPS requests to FMC with directory traversal patterns
Unusual file transfer patterns from FMC

SIEM Query:

source="fmc_logs" AND (http_uri="*../*" OR http_uri="*..\\*" OR http_uri="*%2e%2e%2f*")

📊 Metadata

CVE ID: CVE-2021-34762

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE: CWE-26

Published: October 27, 2021

Last Updated: November 21, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Firepower Management Center Virtual Appliance by Cisco

Firepower Management Center Virtual Appliance by Cisco

Firepower Management Center Virtual Appliance by Cisco

Firepower Management Center Virtual Appliance by Cisco

Firepower Management Center Virtual Appliance by Cisco

Firepower Management Center Virtual Appliance by Cisco

Firepower Management Center Virtual Appliance by Cisco

Firepower Management Center Virtual Appliance by Cisco

Firepower Management Center Virtual Appliance by Cisco

Firepower Management Center Virtual Appliance by Cisco

Firepower Threat Defense by Cisco

Firepower Threat Defense by Cisco

Firepower Threat Defense by Cisco

Firepower Threat Defense by Cisco

Sourcefire Defense Center by Cisco

Sourcefire Defense Center by Cisco

Sourcefire Defense Center by Cisco

Sourcefire Defense Center by Cisco

Sourcefire Defense Center by Cisco

Sourcefire Defense Center by Cisco

Sourcefire Defense Center by Cisco

Sourcefire Defense Center by Cisco

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Restrict Web Interface Access

Enforce Strong Authentication

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities