CVE-2024-20412
CRITICALDescription
A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthenticated, local attacker to access an affected system using static credentials. This vulnerability is due to the presence of static accounts with hard-coded passwords on an affected system. An attacker could exploit this vulnerability by logging in to the CLI of an affected device with these credentials. A successful exploit could allow the attacker to access the affected system and retrieve sensitive information, perform limited troubleshooting actions, modify some configuration options, or render the device unable to boot to the operating system, requiring a reimage of the device.
Is your site exposed to CVE-2024-20412?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_threat_defense |
| cisco | firepower_1000 |
| cisco | firepower_1010 |
| cisco | firepower_1020 |
| cisco | firepower_1030 |
| cisco | firepower_1040 |
| cisco | firepower_1120 |
| cisco | firepower_1140 |
| cisco | firepower_1150 |
| cisco | firepower_2100 |
| cisco | firepower_2110 |
| cisco | firepower_2120 |
| cisco | firepower_2130 |
| cisco | firepower_2140 |
| cisco | firepower_3105 |
| cisco | firepower_3110 |
| cisco | firepower_3120 |
| cisco | firepower_3130 |
| cisco | firepower_3140 |
| cisco | firepower_4215 |
| cisco | firepower_4225 |
| cisco | firepower_4245 |
References
Frequently Asked Questions
What is CVE-2024-20412? +
How severe is CVE-2024-20412? +
What products are affected by CVE-2024-20412? +
How do I check if I'm vulnerable to CVE-2024-20412? +
Related Vulnerabilities
A vulnerability was identified in SUR-FBD CMMS where hard-coded credentials were found within a compiled DLL file. These credentials correspond …
Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform …
Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized …
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains hard coded password …
A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services …
CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens …