CVE-2024-20388
high-risk
Published 2024-10-23
A vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to determine valid user names on an affected device. This vulnerability is due to improper authentication of password update responses. An attacker could exploit this vulnerability by forcing a password reset on an affected device. A successful exploit could allow the attacker to determine valid user names in the unauthenticated response to a forced password reset.
Do I need to act?
-
0.74% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10
Medium
NETWORK
/ LOW complexity
Affected Products (20)
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Firepower Management Center
Affected Vendors
References (1)
53
/ 100
high-risk
Severity
21/34 · High
Exploitability
2/34 · Minimal
Exposure
30/34 · Critical