CVE-2024-20424

Q: What is the severity of CVE-2024-20424?

CVE-2024-20424 has a CVSS score of 9.9 (CRITICAL). This vulnerability allows authenticated attackers with at least Security Analyst (Read Only) privileges to execute arbitrary commands as root on Cisco Secure Firewall Management Center devices. It affects Cisco FMC software due to insufficient HTTP request validation. Attackers could also execute commands on managed Firepower Threat Defense devices through the compromised FMC.

9.9 CRITICAL

Remote Code Execution

📋 TL;DR

This vulnerability allows authenticated attackers with at least Security Analyst (Read Only) privileges to execute arbitrary commands as root on Cisco Secure Firewall Management Center devices. It affects Cisco FMC software due to insufficient HTTP request validation. Attackers could also execute commands on managed Firepower Threat Defense devices through the compromised FMC.

💻 Affected Systems

Products:

Cisco Secure Firewall Management Center (formerly Firepower Management Center)

Versions: Multiple versions up to and including 7.4.1

Operating Systems: Cisco FMC appliance OS

Default Config Vulnerable: ⚠️ Yes

Notes: All deployments with web management interface enabled are vulnerable. Requires at least Security Analyst (Read Only) role credentials.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the FMC device and all managed FTD devices, allowing attackers to disable security controls, exfiltrate sensitive data, pivot to internal networks, and establish persistent backdoors.

🟠

Likely Case

Attackers with valid credentials (including compromised accounts) gain full control of the FMC device, potentially modifying firewall rules, disabling security policies, and accessing sensitive network information.

🟢

If Mitigated

With proper network segmentation, strong authentication controls, and limited privileged accounts, impact is contained to the FMC management network segment.

🌐 Internet-Facing: HIGH

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires valid credentials but is straightforward once authenticated. The vulnerability is in the web interface, making it accessible to attackers with network access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 7.4.1 and later fixed versions

Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmd-inj-v3AWDqN7

Restart Required: Yes

Instructions:

1. Backup current configuration. 2. Download appropriate fixed version from Cisco Software Center. 3. Follow Cisco upgrade procedures for FMC. 4. Verify upgrade completion and functionality.

🔧 Temporary Workarounds

Restrict Management Access

all

Limit access to the FMC web interface to trusted IP addresses only using network ACLs or firewall rules.

Implement Strong Authentication Controls

all

Enforce multi-factor authentication, strong password policies, and regular credential rotation for all FMC user accounts.

🧯 If You Can't Patch

Isolate FMC management interface to dedicated VLAN with strict access controls
Implement network monitoring for unusual HTTP requests to FMC interface

🔍 How to Verify

Check if Vulnerable:

Check FMC software version via web interface (System > Updates) or CLI command 'show version'

Check Version:

show version | include Version

Verify Fix Applied:

Verify version is 7.4.1 or later fixed version and check Cisco advisory for specific fixed releases

📡 Detection & Monitoring

Log Indicators:

Unusual HTTP requests to FMC web interface
Unexpected command execution logs
Authentication from unusual IP addresses

Network Indicators:

HTTP POST requests with unusual parameters to FMC management interface
Outbound connections from FMC to unexpected destinations

SIEM Query:

source="fmc.logs" AND (http_method="POST" AND (uri_contains("/api/") OR param_contains("command")))

📊 Metadata

CVE ID: CVE-2024-20424

CVSS v3 Score: 9.9 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-78

Published: October 23, 2024

Last Updated: November 1, 2024

🔗 References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmd-inj-v3AWDqN7 Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco

Secure Firewall Management Center by Cisco