CVE-2024-20482
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to elevate privileges on an affected device. Exploitation requires a valid account configured with a custom read-only role; the attacker performs a write operation due to insufficient validation of role permissions and could modify certain parts of the configuration.
Risk Assessment
An attacker with a low-privileged account may modify device configuration, potentially weakening security and affecting firewall management.
Recommendation
Apply the Cisco FMC updates specified by the vendor and review and restrict accounts with custom read-only roles.
Other vulnerabilities in Cisco Secure Firewall Management Center
See all- CVE-2026-20242Critical
Vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) allows an unauthenticated remote attacker to execute arbitrary commands as root. It is due to insecure deserialization of a user-supplied Java byte stream from a host in the external database access list.
- CVE-2026-20079CriticalActively exploited
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software allows an unauthenticated, remote attacker to bypass authentication and execute script files to obtain root access to the underlying operating system. This is due to an improper system process created at boot time.
- CVE-2026-20044Medium
A vulnerability in the lockdown mechanism of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, local attacker to perform arbitrary commands as root. This is due to insufficient restrictions on remediation modules while in lockdown mode. An attacker could exploit this by sending crafted input to the system CLI.
Original NVD description (English source)
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to elevate privileges on an affected device. To exploit this vulnerability, an attacker must have a valid account on the device that is configured with a custom read-only role. This vulnerability is due to insufficient validation of role permissions in part of the web-based management interface. An attacker could exploit this vulnerability by performing a write operation on the affected part of the web-based management interface. A successful exploit could allow the attacker to modify certain parts of the configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS