EUVD-2026-50404
GHSA-x85f-hvgg-4944
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Hardcoded credentials eliminate any authentication prerequisite (PR:N); C:L reflects read-only access to sensitive data as a low-privileged account with no integrity or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
AnalysisAI
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote attacker to log in to the web interface using a built-in low-privileged account and access sensitive data. The flaw affects an extensive range of FMC versions from 7.0.0 through 10.0.1 and is rooted in CWE-259 (Use of Hard-coded Password). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special target-side configuration is required - the hardcoded credentials are present in all affected FMC versions by default and cannot be disabled or rotated by administrators. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium), reflecting limited confidentiality impact from a low-privileged account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans for internet-exposed Cisco FMC web interfaces, authenticates to the login portal using the known hardcoded static credentials, and gains read access to sensitive firewall configuration data, policy rules, and event logs as a low-privileged user. Armed with this configuration intelligence and an authenticated session, the attacker then leverages a separate Cisco FMC vulnerability (as Cisco explicitly warns) to escalate privileges, ultimately gaining administrative control over the FMC and all managed Cisco Secure Firewall appliances. … |
| Remediation | The primary remediation is to upgrade Cisco Secure FMC Software to a fixed release as specified in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh - specific fixed version numbers should be obtained directly from that advisory, as they are not independently confirmed from available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-259 – Use of Hard-coded Password
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today