EUVD-2026-50404
GHSA-x85f-hvgg-4944
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Hardcoded credentials eliminate any authentication prerequisite (PR:N); C:L reflects read-only access to sensitive data as a low-privileged account with no integrity or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
AnalysisAI
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote attacker to log in to the web interface using a built-in low-privileged account and access sensitive data. The flaw affects an extensive range of FMC versions from 7.0.0 through 10.0.1 and is rooted in CWE-259 (Use of Hard-coded Password). Cisco has self-elevated the Security Impact Rating to High - despite a CVSS 5.3 Medium score - explicitly because this credential foothold can be chained with other FMC vulnerabilities to escalate privileges, making the real-world risk materially higher than the base score implies. No public exploit or CISA KEV listing has been confirmed at time of analysis.
Technical ContextAI
Cisco Secure Firewall Management Center is the centralized policy and event management platform for Cisco Firepower and Secure Firewall sensor appliances; compromise of FMC directly affects the security posture of all managed firewalls. The root cause is CWE-259 (Use of Hard-coded Password): static credentials for a low-privileged account are compiled into the FMC software, making them identical across every deployed instance and impossible to rotate without a patch. The web management interface is the exposed attack surface, reachable over HTTPS from any network that can reach the FMC management IP. The CPE cpe:2.3:a:cisco:cisco_secure_firewall_management_center_(fmc):*:*:*:*:*:*:*:* with a wildcard version field confirms that the flaw spans the entire product line across dozens of 7.x and 10.x builds, as enumerated by EUVD data.
RemediationAI
The primary remediation is to upgrade Cisco Secure FMC Software to a fixed release as specified in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh - specific fixed version numbers should be obtained directly from that advisory, as they are not independently confirmed from available intelligence data. As an immediate compensating control, Cisco explicitly notes that restricting the FMC management interface from public internet access reduces the attack surface; implement strict ACLs or firewall rules to limit management interface access to trusted administrative subnets only, which prevents unauthenticated remote exploitation while a patch window is scheduled. Note that this restriction does not eliminate the vulnerability for attackers with network access to the management segment - it only raises the access bar from internet-wide to intranet-reachable. Patching remains the only definitive fix since the hardcoded credentials cannot be changed or rotated by administrators.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root o
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Se
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-managemen
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authent
Same weakness CWE-259 – Use of Hard-coded Password
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today