CVE-2024-20361: cisco cisco firepower management center
Vulnerability summary
CVE-2024-20361 is a medium (CVSS 5.8) vulnerability in cisco cisco firepower management center. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.4% of scored vulnerabilities.
Timeline
- 22-05-2024PublishedVulnerability first disclosed.
- 01-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass configured access controls on managed devices that are running Cisco Firepower Threat Defense (FTD) Software. This vulnerability is due to the incorrect deployment of the Object Groups for ACLs feature from Cisco FMC Software to managed FTD devices in high-availability setups. After an affected device is rebooted following Object Groups for ACLs deployment, an attacker can exploit this vulnerability by sending traffic through the affected device. A successful exploit could allow the attacker to bypass configured access controls and successfully send traffic to devices that are expected to be protected by the affected device.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco3 products
- cisco firepower management center7.1.0 | 7.1.0.1 | 7.1.0.2 | 7.1.0.3 | 7.2.0 | 7.2.1 | 7.2.2 | 7.2.0.1 | 7.2.3 | 7.2.3.1 | 7.3.0 | 7.3.1
- cisco firepower threat defense softwaren/a
- secure_firewall_management_center7.1.0 | 7.1.0.1 | 7.1.0.2 | 7.1.0.3 | 7.2.0 | 7.2.0.1 | 7.2.1 | 7.2.2 | 7.2.3 | 7.2.3.1 | 7.3.0 | 7.3.1
1 vendor · 3 products
References
1 links- sec.cloudapps.cisco.com/security/…Vendor Advisory