Read the docs
TI-2019-09471 Aliases CVE-2019-12675GHSA-mr95-5fwr-mf38

Cisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities

Priority MEDIUM 41CWE-216Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. These vulnerabilities are due to insufficient protections on the underlying filesystem. An attacker could exploit these vulnerabilities by modifying critical files on the underlying filesystem. A successful exploit could allow the attacker to execute commands with root privileges within the host namespace. This could allow the attacker to impact other running FTD instances.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0074 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Firepower Threat Defense Softwareall versions—No fix listedCNA
  • Cisco Firepower Threat Defense Software VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*before 6.4.0.2VulnerableCisco
cpe:2.3:o:cisco:firepower_9300_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:firepower_4115_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:firepower_4125_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:firepower_4145_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:firepower_4110_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* Versions before 6.4.0.2 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:firepower_9300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:firepower_4115_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:firepower_4125_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:firepower_4145_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:firepower_4110_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:firepower_4120_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:firepower_4140_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:firepower_4150_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:firepower_4120_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:firepower_4140_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:firepower_4150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Cisco Firepower Threat Defense Software — 20191002 Cisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2019-09470 Cisco Firepower Threat Defense Software Multi-instance Container Escape VulnerabilitiesPriority LOW 39
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-12675
  2. 2026-10-03 Alias added: GHSA-mr95-5fwr-mf38

References

Advisory 1

  • TI-2019-09470 Cisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities CVSS 3.1HIGH 8.2
  • TI-2022-05424 Cisco FXOS Software Command Injection Vulnerability CVSS 3.1MEDIUM 6.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences