SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20340

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score32/100 — MITTEL
  • CVSS 8.8 — Hoch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP payload. A successful exploit could allow the attacker to save the crafted payload and then execute it on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only).

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "sftunnel" and ProcessCommandLine contains "RPC" and ProcessCommandLine contains "deserialization"

Splunk SPL

index=* (sourcetype=cisco:fmc OR sourcetype=cisco:secure:fmc) (sftunnel AND RPC AND deserialization)

Sigma

title: Cisco FMC sftunnel Deserialization
logsource:
  product: cisco
  service: fmc
detection:
  selection:
    - sftunnel:
        - '*RPC*'
        - '*deserialization*'
  condition: selection
level: high

Elastic ES|QL

from logs-cisco.fmc.*
| where message : "sftunnel" and message : "RPC" and message : "deserialization"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen