Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using Cisco Secure Firewall Management Center (FMC) Software
Incident: Active exploitation of a zero-day vulnerability involving static credentials.
Impact: Unauthorized access to sensitive data and potential full system compromise via vulnerability chaining.
Attacker: Unidentified threat actors
Analysis: Threat actors are leveraging static credentials in Cisco Secure FMC Software to gain initial access as low-privileged users. While the initial vulnerability is moderate, the real danger lies in the potential to chain it with other bugs to achieve full root execution. CISA has already added the vulnerability to its KEV catalog due to confirmed wild exploitation.
Recommendations: Apply the vendor-provided hot fixes for the specific FMC software version immediately.; Restrict the FMC management interface from public internet access to reduce attack surface.; Search system logs for ‘/var/tmp/license.tmp’ to identify potential compromise.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source