A vulnerability was found in the Cisco Firepower Device Manager (FDM) On-Box software from Cisco that could lead to remote code execution. In the capable hands of threat actors, such flaw could allow to gain control over the attacked firewall.

The security problem was discovered by Positive Technologies experts Nikita Abramov and Mikhail Klyuchnikov. According to them, the flaw was in the REST API of the embedded Cisco FDM On-Box software. As a result, a potential attacker could execute arbitrary code on the operating system of the affected device. The bug affects the following Cisco FDM On-Box versions: 6.3.0, 6.4.0, 6.5.0, 6.6.0 and 6.7.0. The developers have patched the flaw with the release of 6.4.0.12, 6.4.4 and 6.7.0.2. Owners of all affected devices are advised to install the released patches.

Source: anti-malware.ru