QID 317187

A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the Security Intelligence DNS feed and could allow an authenticated, local attacker to inject XML into the command parser.

Affected Products
At the time of publication, this vulnerability affected Cisco FTD Software.

Vulnerable Version:
All Versions prior to 6.2.3 6.3.0 prior to 6.4.0.15
6.5.0 prior to 6.6.5.2
6.7.0 prior to 7.0.2

A successful exploit could allow the attacker to bypass device controls and successfully send traffic to devices that are expected to be protected by the affected device and to inject XML into the command parser, which could result in unexpected processing of the command and unexpected command output.