CVE-2024-20412
Estado: AnalizadaAlta (8.4)—
A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthenticated, local attacker to access an affected system using static credentials.
This vulnerability is due to the presence of static accounts with hard-coded passwords on an affected system. An attacker could exploit this vulnerability by logging in to the CLI of an affected device with these credentials. A successful exploit could allow the attacker to access the affected system and retrieve sensitive information, perform limited troubleshooting actions, modify some configuration options, or render the device unable to boot to the operating system, requiring a reimage of the device.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.4
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 11
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation85 % - Impacto principal
T1078.001Default Accountsstealth · persistence · privilege escalation · initial access90 % - Impacto secundario
T1005Data from Local Systemcollection75 % - Impacto secundario
T1565.001Stored Data Manipulationimpact70 %
AV:L sin UI permite escalada local con credenciales estáticas. Impactos: acceso a CLI, lectura de información sensible, modificación de configuración y corrupción del sistema.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-259
- CWE-798
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-20412",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-20412",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-10-25T00:00:00+00:00"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 9.3,
"attackVector": "LOCAL",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 2.5
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.4,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.5
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Firepower Threat Defense Software",
"versions": [
{
"status": "affected",
"version": "7.1.0"
},
{
"status": "affected",
"version": "7.1.0.1"
},
{
"status": "affected",
"version": "7.1.0.2"
},
{
"status": "affected",
"version": "7.1.0.3"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.2.0.1"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.2.3"
},
{
"status": "affected",
"version": "7.2.4"
},
{
"status": "affected",
"version": "7.2.4.1"
},
{
"status": "affected",
"version": "7.2.5"
},
{
"status": "affected",
"version": "7.2.5.1"
},
{
"status": "affected",
"version": "7.2.6"
},
{
"status": "affected",
"version": "7.2.7"
},
{
"status": "affected",
"version": "7.2.5.2"
},
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.4.1.1"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*"
],
"vendor": "cisco",
"product": "firepower_threat_defense_software",
"versions": [
{
"status": "affected",
"version": "7.1.0",
"versionType": "custom",
"lessThanOrEqual": "7.1.0.3"
},
{
"status": "affected",
"version": "7.2.0",
"versionType": "custom",
"lessThanOrEqual": "7.2.7"
},
{
"status": "affected",
"version": "7.3.0",
"versionType": "custom",
"lessThanOrEqual": "7.3.1.2"
},
{
"status": "affected",
"version": "7.4.0",
"versionType": "custom",
"lessThanOrEqual": "7.4.1.1"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-10-23T18:15:09.430",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-statcred-dFC8tXT5",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-259"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-798"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthenticated, local attacker to access an affected system using static credentials.\r\n\r This vulnerability is due to the presence of static accounts with hard-coded passwords on an affected system. An attacker could exploit this vulnerability by logging in to the CLI of an affected device with these credentials. A successful exploit could allow the attacker to access the affected system and retrieve sensitive information, perform limited troubleshooting actions, modify some configuration options, or render the device unable to boot to the operating system, requiring a reimage of the device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el software Cisco Firepower Threat Defense (FTD) para Cisco Firepower 1000, 2100, 3100 y 4200 Series podría permitir que un atacante local no autenticado acceda a un sistema afectado utilizando credenciales estáticas. Esta vulnerabilidad se debe a la presencia de cuentas estáticas con contraseñas codificadas en un sistema afectado. Un atacante podría aprovechar esta vulnerabilidad iniciando sesión en la CLI de un dispositivo afectado con estas credenciales. Una explotación exitosa podría permitir al atacante acceder al sistema afectado y recuperar información confidencial, realizar acciones limitadas de resolución de problemas, modificar algunas opciones de configuración o hacer que el dispositivo no pueda iniciarse en el sistema operativo, lo que requiere una nueva imagen del dispositivo."
}
],
"lastModified": "2026-08-11T19:33:44.513",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3AD3F514-9FBC-403C-8F8F-2507708D685F"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2155D80A-74AE-4403-8EC4-19054DE3476E"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C69CE022-5FBF-48AE-B6AA-873261A201D1"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.1.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30F5FE5C-E3BE-4C32-BB6F-E3785BA6CD15"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "237462A2-E0CF-4201-9115-D94910F9745B"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2CA2F5B0-0106-4FF2-91BD-AEF3F064F69E"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF9FFE56-9A00-456E-B097-114F714133BD"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E253A08-B4D4-4E81-9D5A-C15D198C43AC"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59C7F868-1571-44CC-90E1-7A5EA01E63FC"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7432B6F9-03CD-4373-B281-2A09864E7828"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D42B7E6-71ED-48BA-B11F-6791FE96C1B2"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39CC3AC6-6F75-43BF-BBC9-F74AADB74716"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FFBAC033-FF89-4581-92F6-EA4FFEE40F54"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5AF3CB27-8315-452F-80E1-5DAF883319B1"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A910367-E5D5-4817-9DAA-3225D4FA8055"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38EC17C6-2DA5-4E26-987A-FD14F539F55B"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD33999C-8DE7-4C0C-A8E5-1BA7127E36FE"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A977F379-2F93-4A56-B0A6-C45AEF274123"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA7FA3B6-D630-42E3-B69F-B20D38B33531"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9B125CC4-0DAE-4C26-9A27-2532BB09EA8A"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BC88149-095A-41DE-AA27-1CFD21125EF4"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA983223-35AE-4D2F-B2F5-BA0614908C3B"
},
{
"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17A31A33-2E84-4C79-86BD-1E9FF4C1DD09"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:firepower_1000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E6F79864-CA70-4192-AC2C-E174DF3F25B2"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7FFE3880-4B85-4E23-9836-70875D5109F7"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_1020:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EA8B5AF8-6A57-482A-9442-E857EE7E207B"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_1030:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A9929280-2AAC-4B56-A42C-1F6EDE83988E"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_1040:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F29B6BC3-D716-4A3D-9679-B7BE81F719C8"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_1120:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "727A02E8-40A1-4DFE-A3A2-91D628D3044F"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_1140:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "19F6546E-28F4-40DC-97D6-E0E023FE939B"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_1150:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EB3B0EC3-4654-4D90-9D41-7EC2AD1DDF99"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_2100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D23A26EF-5B43-437C-A962-4FC69D8A0FF4"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "52D96810-5F79-4A83-B8CA-D015790FCF72"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "16FE2945-4975-4003-AE48-7E134E167A7F"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DCE7122A-5AA7-4ECD-B024-E27C9D0CFB7B"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "976901BF-C52C-4F81-956A-711AF8A60140"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_3105:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7B65E122-8B8C-4681-9CAE-C375292A26CC"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_3110:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "012CCE97-B6FE-45B8-9599-D64EE0F80B2A"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_3120:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A6A73EAE-3C2E-4836-97EC-F644E219C0DD"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_3130:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2DCF7A7F-9564-4A8D-84FA-7DA25B4BF4B7"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_3140:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "542C19EA-0FFE-4ADC-93BB-EEB6B0A8CAA9"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_4215:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2634F9A1-8CF7-4824-817A-F617DB48CFFF"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_4225:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F021E6A8-FA39-40BD-B570-D5C4F408521C"
},
{
"criteria": "cpe:2.3:h:cisco:firepower_4245:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B303B6B7-B419-46F1-9291-E70AD1B863D7"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@cisco.com"
}