CVE-2021-34761

Summary

CVE	CVE-2021-34761
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-10-27 19:15:00 UTC
Updated	2023-11-07 03:36:00 UTC
Description	A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The attacker must have administrative credentials on the device. This vulnerability is due to incomplete validation of user input for a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device with administrative privileges and issuing a CLI command with crafted user parameters. A successful exploit could allow the attacker to overwrite or append arbitrary data to system files using root-level privileges.

Risk And Classification

Problem Types: CWE-668

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Cisco	Firepower Management Center Virtual Appliance	6.2.3	All	All	All
Application	Cisco	Firepower Management Center Virtual Appliance	6.4.0	All	All	All
Application	Cisco	Firepower Management Center Virtual Appliance	6.6.1	All	All	All
Application	Cisco	Firepower Management Center Virtual Appliance	6.7.0	All	All	All
Application	Cisco	Firepower Management Center Virtual Appliance	7.0.0	All	All	All
Application	Cisco	Firepower Management Center Virtual Appliance	7.1.0	All	All	All
Application	Cisco	Firepower Threat Defense	All	All	All	All
Application	Cisco	Sourcefire Defense Center	6.2.3	All	All	All
Application	Cisco	Sourcefire Defense Center	6.4.0	All	All	All
Application	Cisco	Sourcefire Defense Center	6.6.1	All	All	All
Application	Cisco	Sourcefire Defense Center	6.7.0	All	All	All
Application	Cisco	Sourcefire Defense Center	7.0.0	All	All	All
Application	Cisco	Sourcefire Defense Center	7.1.0	All	All	All

References

Reference	Source	Link	Tags
Cisco Firepower Threat Defense Software CLI Arbitrary File Write Vulnerability	CISCO	tools.cisco.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

317098 Cisco Firepower Threat Defense (FTD) Software Command Line Interface (CLI) Arbitrary File Write Vulnerability (cisco-sa-ftd-file-write-SHVcmQVc)