What’s Vulnerable › Vulnerabilities

CVE-2019-1709: Cisco Firepower Threat Defense Software Command Injection Vulnerability

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-05-03 · updated 2026-08-11
• Weakness: CWE-78

Description

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting commands into arguments for a specific command. A successful exploit could allow the attacker to execute commands with root privileges.

Affected products

• Cisco Firepower Management Center: 6.3.0
• Cisco Firepower Threat Defense Software: 6.0.0, 6.0.1, 6.1.0, 6.2.0, 6.2.1, 6.2.2 (+1)

References

• http://www.securityfocus.com/bid/108156
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-frpwr-cmd-inj
• http://www.securityfocus.com/bid/108156
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-frpwr-cmd-inj

Get alerted when CVE-2019-1709 or the next vulnerability affects your stack