Cisco has issued hotfix patches for a critical vulnerability in its network security tool, Cisco Firepower Management Center (FMC).
The flaw, tracked as CVE-2019-16028, is due to improper handling of Lightweight Directory Access Protocol (LDAP) authentication responses from an external server. The flaw could be exploited by a remote attacker to bypass authentication and execute arbitrary actions on a vulnerable device with administrator-level privileges through the web-based management interface. The flaw could be exploited by sending specially crafted HTTP requests to a vulnerable device. The vulnerability has been assigned a CVSS v3 score of 9.8 out of 10.
The vulnerability affects Cisco FMC Software when it is configured to authenticate users of the web management interface through an external LDAP server.
Cisco notes that there are no workarounds or mitigations other than applying the patches. Hotfix patches have been included for versions 6.4.0.7 and 6.5.0.2, although the latter is no longer available for download.
The vulnerability will be corrected in version 6.2.3.16, which is scheduled for release in February 2020, and 6.3.0.6 which us due for release in May 2020.
Versions prior to 6.1.0 have reached the end of the maintenance period and users have been advised to upgrade to 6.2.3 and apply the hotfix patch. Users of version 6.1.0 should apply the hotfix patch or upgrade to version 6.2.3 and apply the patch. Users of versions 6.2.0 to 6.2.2 should upgrade to 6.2.3 and apply the hotfix patch.
There are currently no known public exploits for the vulnerability.
In addition to the patch for CVE-2019-16028, Cisco has also released 7 patches to address high severity vulnerabilities in the following products:
- TelePresence Collaboration Endpoint
- TelePresence Codec
- RoomOS Software
- IOS XE SD-WAN Software
- SD-WAN Solution vManage software
- Smart Software Manager On-Prem
- IOS XR Software
Users of the above products have been advised to apply the patches as soon as possible to prevent exploitation. If the flaws are exploited, they could result in unauthorized device access, privilege escalation, and directory traversal and denial of service (DoS) attacks.