CVE-2020-3253

A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. The vulnerability is due to improper configuration of the support tunnel feature. An attacker could exploit this vulnerability by enabling the support tunnel, setting a key, and deriving the tunnel password. A successful exploit could allow the attacker to run any system command with root access on an affected device.

A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. The vulnerability is due to improper configuration of the support tunnel feature. An attacker could exploit this vulnerability by enabling the support tunnel, setting a key, and deriving the tunnel password. A successful exploit could allow the attacker to run any system command with root access on an affected device.

Una vulnerabilidad en la funcionalidad support tunnel del Cisco Firepower Threat Defense (FTD) Software, podría permitir a un atacante local autenticado acceder al shell de un dispositivo afectado aunque el modo expert esté desactivado. La vulnerabilidad es debido a una configuración inapropiada de la funcionalidad support tunnel. Un atacante podría explotar esta vulnerabilidad al habilitar support tunnel, establecer una clave y derivar la contraseña de tunnel. Una explotación con éxito podría permitir a un atacante ejecutar cualquier comando del sistema con acceso root sobre un dispositivo afectado.