Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities
Priority MEDIUM 42CWE-693Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-693.
Summary
Multiple vulnerabilities in the Cisco Firepower System Software Detection Engine could allow an unauthenticated, remote attacker to bypass configured Malware and File Policies for RTF and RAR file types. For more information about these vulnerabilities, see the Details section of this advisory.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01455 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco FireSIGHT System Software | all versions | — | No fix listed | CNA |
- Cisco FireSIGHT System Software VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:firepower:6.2.3.1:*:*:*:*:*:*:* | 6.2.3.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:firepower:6.2.3.7:*:*:*:*:*:*:* | 6.2.3.7 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:firepower:6.3.0:*:*:*:*:*:*:* | 6.3.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:firepower:6.4.0:*:*:*:*:*:*:* | 6.4.0 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5500-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_1120:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_1140:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:a:cisco:firepower:6.2.3.1:*:*:*:*:*:*:* Versions 6.2.3.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:firepower:6.2.3.7:*:*:*:*:*:*:* Versions 6.2.3.7 Vulnerable ·Cisco
- cpe:2.3:a:cisco:firepower:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:firepower:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5500-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_1120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_1140:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_7000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_8000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_threat_defense_for_isr:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ftd_virtual:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:isa_3000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:ngipsv_for_vmware:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_8000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_threat_defense_for_isr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ftd_virtual:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:isa_3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:ngipsv_for_vmware:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Cisco FireSIGHT System Software — 20191002 Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2019-09491 Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass VulnerabilitiesPriority MEDIUM 42
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12697
- 2026-10-03 Alias added: GHSA-rrfx-pqr3-w8hw
References
More Cisco Firepower vulnerabilities
- TI-2019-09491 Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities CVSS 3.1HIGH 7.5
- TI-2018-00231 Resource management flaw in Cisco Firepower Threat Defense CVSS 3.0MEDIUM 5.9
- TI-2015-05294 Cisco FirePOWER (formerly Sourcefire) 7000 and 8000 devices with software 5.4.0.1 allow… CVSS 2.0MEDIUM 6.1
Sources
- CVE-2019-12697 · CVE Program
- CVE-2019-12697 · NVD
- FIRST EPSS
- GHSA-rrfx-pqr3-w8hw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences