CVE-2022-20729
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject XML into the command parser. This is due to insufficient input validation. Successful exploitation could result in unexpected processing of commands and unexpected output.
Risk Assessment
Risk of device malfunction or unauthorized information disclosure due to XML injection.
Recommendation
Update FTD software to a patched version. Restrict CLI access to trusted administrators.
Original NVD description (English source)
A vulnerability in CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands. A successful exploit could allow the attacker to inject XML into the command parser, which could result in unexpected processing of the command and unexpected command output.