CVE-2021-1477: Cisco Firepower Management Center Software Policy Vulnerability

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-29 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability in an access control mechanism of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to access services beyond the scope of their authorization. This vulnerability is due to insufficient enforcement of access control in the affected software. An attacker could exploit this vulnerability by directly accessing the internal services of an affected device. A successful exploit could allow the attacker to overwrite policies and impact the configuration and operation of the affected device.

Affected products

Cisco Firepower Management Center: before 6.4.0.12; from 6.5.0 before 6.6.3; from 6.7.0 before 6.7.0.2 — fixed in 6.4.0.12, 6.6.3, 6.7.0.2

How to fix

Upgrade to a fixed version: Cisco Firepower Management Center 6.4.0.12, 6.6.3, 6.7.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-1477 or the next vulnerability affects your stack