Cisco Firepower Device Manager On-Box Software Remote Code Execution Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to insufficient sanitization of user input on specific REST API commands. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API subsystem of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system. To exploit this vulnerability, an attacker would need valid low-privileged user credentials.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Firepower Threat Defense Software | all versions | — | No fix listed | CNA |
- Cisco Firepower Threat Defense Software VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:firepower_device_manager_on-box:*:*:*:*:*:*:*:* | 6.3.0 to before 6.4.0; 6.5.0 to before 6.7.0.2 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:firepower_device_manager_on-box:*:*:*:*:*:*:*:* Versions 6.3.0 to before 6.4.0; 6.5.0 to before 6.7.0.2 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-1518
- 2026-10-03 Alias added: GHSA-jrp9-wjr5-77p4
References
More Cisco Firepower Device Manager On-box vulnerabilities
- TI-2020-02866 Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerability CVSS 3.1HIGH 7.2
- TI-2020-02867 Cisco Firepower Device Manager On-Box Software XML Parsing Vulnerability CVSS 3.1MEDIUM 4.9
Sources
- CVE-2021-1518 · CVE Program
- CVE-2021-1518 · NVD
- FIRST EPSS
- GHSA-jrp9-wjr5-77p4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences