EUVD-2026-81103
GHSA-m3pq-vq89-c8m5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network sftunnel path (AV:N), low complexity (AC:L), requires valid credentials or a registered peer (PR:L), and a peer/user foothold escalating to root device compromise justifies S:C with full C:H/I:H/A:H.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands as root.
This vulnerability exists because a registered sftunnel peer has incorrect permissions to write an arbitrary file to any location on the device. An attacker could exploit this vulnerability by hijacking the sftunnel communication connection or being a valid registered sftunnel peer and sending an sftunnel command to write a malicious file to the disk of an affected device. A successful exploit could allow the attacker to write a file to the device that is executed with root privileges. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
AnalysisAI
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker who possesses valid user credentials on the FMC - or who can hijack an established sftunnel peer connection - can send a crafted sftunnel command that writes a malicious file to any location on the device, and that file is then executed with root privileges (CVSS 9.9, CWE-862). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to either possess valid user credentials on the affected Cisco Secure FMC or to control/hijack a registered sftunnel peer connection, then issue an sftunnel inter-device protocol command that writes an arbitrary file to disk; the planted file is subsequently executed with root privileges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed release version is provided in the available data; Cisco's advisory (cisco-sa-fmc-sftunn-codex-c3O4Jft2) should be consulted for the patched software version and any available hotfixes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco Secure Firewall Management Center (FMC) deployment in the environment, record its exact software release, and confirm which accounts hold valid FMC user credentials; immediately reduce that population to the minimum necessary, rotate any shared or stale credentials, enforce multi-factor authentication where supported, and audit FMC audit/authentication logs for unexpected sftunnel activity or file writes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote a
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root o
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Se
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-managemen
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authent
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today