5.3 CVE-2026-20316

Enriched by CISA CISA Kev Catalog
 

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.  Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.   Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
https://nvd.nist.gov/vuln/detail/CVE-2026-20316

Categories

CWE-259 : Use of Hard-coded Password
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) For outbound authentication: store passwords outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible. For inbound authentication: Rather than hard-code a default username and password for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password. Perform access control checks and limit which entities can access the feature that requires the hard-coded password. For example, a feature might only be enabled through the system console instead of through a network connection. Distributed Control System (DCS) has hard-coded passwords for local shell access Telnet service for IoT feeder for dogs and cats has hard-coded password [REF-1288] Firmware for a WiFi router uses a hard-coded password for a BusyBox shell, allowing bypass of authentication through the UART port

References


 

AFFECTED (from MITRE)

Vendor Product Versions
Cisco Cisco Secure Firewall Management Center (FMC)
  • 7.0.0 [affected]
  • 7.0.0.1 [affected]
  • 7.0.1 [affected]
  • 7.0.1.1 [affected]
  • 7.0.2 [affected]
  • 7.2.0 [affected]
  • 7.0.2.1 [affected]
  • 7.0.3 [affected]
  • 7.2.0.1 [affected]
  • 7.0.4 [affected]
  • 7.2.1 [affected]
  • 7.0.5 [affected]
  • 7.3.0 [affected]
  • 7.2.2 [affected]
  • 7.3.1 [affected]
  • 7.2.3 [affected]
  • 7.2.3.1 [affected]
  • 7.2.4 [affected]
  • 7.0.6 [affected]
  • 7.2.4.1 [affected]
  • 7.2.5 [affected]
  • 7.3.1.1 [affected]
  • 7.4.0 [affected]
  • 7.0.6.1 [affected]
  • 7.2.5.1 [affected]
  • 7.4.1 [affected]
  • 7.2.6 [affected]
  • 7.4.1.1 [affected]
  • 7.0.6.2 [affected]
  • 7.2.7 [affected]
  • 7.2.5.2 [affected]
  • 7.3.1.2 [affected]
  • 7.2.8 [affected]
  • 7.6.0 [affected]
  • 7.4.2 [affected]
  • 7.2.8.1 [affected]
  • 7.0.6.3 [affected]
  • 7.4.2.1 [affected]
  • 7.2.9 [affected]
  • 7.0.7 [affected]
  • 7.7.0 [affected]
  • 7.4.2.2 [affected]
  • 7.2.10 [affected]
  • 7.6.1 [affected]
  • 7.4.2.3 [affected]
  • 7.0.8 [affected]
  • 7.6.2 [affected]
  • 7.7.10 [affected]
  • 7.2.10.1 [affected]
  • 7.0.8.1 [affected]
  • 7.6.2.1 [affected]
  • 7.2.10.2 [affected]
  • 7.7.10.1 [affected]
  • 7.4.2.4 [affected]
  • 7.4.3 [affected]
  • 7.7.11 [affected]
  • 7.6.4 [affected]
  • 10.0.0 [affected]
  • 7.4.4 [affected]
  • 7.4.5 [affected]
  • 7.0.9 [affected]
  • 7.2.11 [affected]
  • 7.7.12 [affected]
  • 7.6.5 [affected]
  • 7.4.6 [affected]
  • 10.0.1 [affected]
  • 7.4.7 [affected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe start end
Configuration 1
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:* >= 7.0.0 <= 7.0.9
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:* >= 7.2.0 <= 7.2.11
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:* >= 7.3.0 <= 7.3.1.2
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:* >= 7.4.0 <= 7.4.7
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:* >= 7.6.0 <= 7.6.5
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:* >= 7.7.0 <= 7.7.12
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:* >= 10.0.0 <= 10.0.1

REMEDIATION


EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
No entry