Cisco Firesight System Software vulnerabilities

35 CVEs affecting Cisco Firesight System Software, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-6766, published 2017-08-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-6335, published 2015-10-25. High severity, CVSS 9.0. EPSS: 2.7% chance of exploitation in the next 30 days. The policy implementation in Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, and 6.0.0 for VMware allows remote authenticated administrators to bypass intended policy restrictions and execute…
CVE-2015-6357, published 2015-11-18. Medium severity, CVSS 6.8. EPSS: 2.6% chance of exploitation in the next 30 days. The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL server, which allows man-in-the-middle…
CVE-2016-6471, published 2016-12-14. Medium severity, CVSS 6.5. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Firepower Management Center running FireSIGHT System software could allow an authenticated, remote attacker to view the Remote Storage…
CVE-2015-4302, published 2015-08-19. Medium severity, CVSS 6.4. EPSS: 2.2% chance of exploitation in the next 30 days. The web interface in Cisco FireSIGHT Management Center 5.3.1.4 allows remote attackers to delete arbitrary system policies via modified parameters in a POST request, aka Bug ID CSCuu25390.
CVE-2016-1463, published 2016-07-28. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Cisco FireSIGHT System Software 5.3.0, 5.3.1, 5.4.0, 6.0, and 6.0.1 allows remote attackers to bypass Snort rules via crafted parameters in the header of an HTTP packet, aka Bug ID CSCuz20737.
CVE-2015-0739, published 2015-05-19. Medium severity, CVSS 4.0. EPSS: 2% chance of exploitation in the next 30 days. The Lights-Out Management (LOM) implementation in Cisco FireSIGHT System Software 5.3.0 on Sourcefire 3D Sensor devices allows remote authenticated users to perform arbitrary Baseboard Management…
CVE-2016-9193, published 2016-12-14. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. A vulnerability in the malicious file detection and blocking features of Cisco Firepower Management Center and Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to…
CVE-2016-6420, published 2016-10-05. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. Cisco FireSIGHT System Software 4.10.3 through 5.4.0 in Firepower Management Center allows remote authenticated users to bypass authorization checks and gain privileges via a crafted HTTP request,…
CVE-2015-6427, published 2015-12-18. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. Cisco FireSIGHT Management Center allows remote attackers to bypass the HTTP attack detection feature and avoid triggering Snort IDS rules via an SSL session that is mishandled after decryption, aka…
CVE-2016-1368, published 2016-05-05. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. Cisco FirePOWER System Software 5.3.x through 5.3.0.6 and 5.4.x through 5.4.0.3 on FirePOWER 7000 and 8000 appliances, and on the Advanced Malware Protection (AMP) for Networks component on these…

Latest

CVE-2017-6766, published 2017-08-07. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, and 6.2.2 could allow an…
CVE-2017-6735, published 2017-07-10. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated, local attacker to execute arbitrary code on a targeted system. More…
CVE-2016-6460, published 2016-11-19. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability in the FTP Representational State Transfer Application Programming Interface (REST API) for Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass…
CVE-2016-6417, published 2016-10-05. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allows remote attackers to hijack the authentication of…
CVE-2016-6411, published 2016-09-24. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Cisco Firepower Management Center and FireSIGHT System Software 6.0.1 mishandle comparisons between URLs and X.509 certificates, which allows remote attackers to bypass intended do-not-decrypt…
CVE-2016-6396, published 2016-09-12. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1, when certain malware blocking options are enabled, allow remote attackers to bypass malware detection via…
CVE-2016-6395, published 2016-09-12. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1 allows remote authenticated…