Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Cisco Firepower Management Center Software Allows Remote XSS Attack

CVE-2024-20410 · published 2 years ago
Summary

An attacker can inject malicious code into the Cisco Firepower Management Center web interface, potentially allowing them to steal user data or take control of the interface. This affects users of the web interface, and it's essential to update the software to the latest version to prevent exploitation. Cisco has released a fix for this vulnerability, so updating to the latest version is recommended.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cisco firepower_management_center 6.4.0.17
6.4.0.18
6.6.7.2
7.0.6.1
7.0.6.2
7.2.5.1
7.2.5.2
7.2.6
7.2.7
7.2.8
7.2.8.1
7.4.0
2 more version ranges
cpe:2.3:a:cisco:firepower_management_center:6.4.0.17:*:*:*:*:*:*:*
cisco secure_firewall_management_center 6.2.3
6.2.3.1
6.2.3.2
6.2.3.3
6.2.3.4
6.2.3.5
6.2.3.6
6.2.3.7
6.2.3.8
6.2.3.9
6.2.3.10
6.2.3.11
65 more version ranges
cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3:*:*:*:*:*:*:*
Original advisory text
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) att...
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by inserting crafted input into various data fields in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface, or access sensitive, browser-based information.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-20410 · NVD
Track software like this
Free during beta