Using Static Credentials in Cisco Secure Firewall Management Center
A vulnerability affecting Cisco Secure Firewall Management Center (FMC) would allow an unauthenticated, remote attacker to connect to the system's web interface and access sensitive information.
Description
Technical context and vulnerability details
Cisco Secure Firewall Management Center (FMC) is a centralized management platform developed by Cisco allowing the administration and monitoring of several Cisco firewalls within the same infrastructure. This platform is affected by a vulnerability labeled CVE-2026-20316, resulting from the presence of static identifiers associated with an integrated user account with limited privileges. Exploitation of this vulnerability could allow a remote, unauthenticated malicious actor to connect to the web administration interface of the affected system and access sensitive information. It is classified as medium with a severity score of 5.3 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Unauthorized access to the administration interface;
- Disclosure of sensitive information;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- Cisco Secure Firewall Management Center (FMC) versions 7.0.0 through 7.0.9 (inclusive);
- Cisco Secure Firewall Management Center (FMC) versions 7.2.0 through 7.2.11 (inclusive);
- Cisco Secure Firewall Management Center (FMC) versions 7.3.0 through 7.3.1.2 (inclusive);
- Cisco Secure Firewall Management Center (FMC) versions 7.4.0 through 7.4.7 (inclusive);
- Cisco Secure Firewall Management Center (FMC) versions 7.6.0 through 7.6.5 (inclusive);
- Cisco Secure Firewall Management Center (FMC) versions 7.7.0 through 7.7.12 (inclusive);
- Cisco Secure Firewall Management Center (FMC) versions 10.0.0 through 10.0.1 (inclusive);
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Cisco Secure Firewall Management Center (FMC) to the latest stable version available;
- Limit access to the administration interface to trusted networks or IP addresses;
- Check system logs for Cisco-provided indicators of compromise;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.