CVE-2022-20949

MEDIUM

4.9

CVSS Score

Published: November 10, 2022 at 05:32 PM UTC

Updated: August 11, 2026 at 07:33 PM UTC

2 products affected across 1 vendorSecure Firewall Threat DefenseFirepower Threat Defense

Using Cisco Firepower Threat Defense Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Firepower Threat Defense Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.9

Exploit prediction

EPSS 0.8%

Description

A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This vulnerability exists because access to HTTPS endpoints is not properly restricted on an affected device. An attacker could exploit this vulnerability by sending specific messages to the affected HTTPS handler. A successful exploit could allow the attacker to perform configuration changes on the affected system, which should be configured and managed only through Cisco Firepower Management Center (FMC) Software.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Secure Firewall Threat Defense · Cisco

95%

6.1.0 ≤ v ≤ 6.1.0.76.2.0 ≤ v ≤ 6.2.0.66.2.2 ≤ v ≤ 6.2.2.56.2.3 ≤ v ≤ 6.2.3.186.3.0 ≤ v ≤ 6.3.0.56.4.0 ≤ v ≤ 6.4.0.156.5.0 ≤ v ≤ 6.5.0.56.6.0 ≤ v ≤ 6.6.5.26.7.0 ≤ v ≤ 6.7.0.37.0.0 ≤ v ≤ 7.0.36.2.1 7.1.0.0 7.1.0.1 7.1.0.2 7.2.0 7.2.0.1