dbcve.org
Secure Firewall Management CenterApplication · Cisco

CVE-2023-20063

HIGH · 8.2 CVSS v3.1 Published 2023-11-01
Fix available
A fix is available. Upgrade to after 7.3.1.1 or later.
See remediation →
84/100
Remediation priority · High
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability in the inter-device communication mechanisms between devices that are running Cisco Firepower Threat Defense (FTD) Software and devices that are running Cisco Firepower Management (FMC) Software could allow an authenticated, local attacker to execute arbitrary commands with root permissions on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by accessing the expert mode of an affected device and submitting specific commands to a connected system. A successful exploit could allow the attacker to execute arbitrary code in the context of an FMC device if the attacker has administrative privileges on an associated FTD device. Alternatively, a successful exploit could allow the attacker to execute arbitrary code in the context of an FTD device if the attacker has administrative privileges on an associated FMC device.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A command injection vulnerability in the inter-device communication channel between Cisco FTD and FMC allows an authenticated administrator on one product to execute arbitrary root-level commands on the peer device by submitting specially crafted commands through expert mode, due to insufficient input validation of user-supplied data in the communication mechanism.

MitigationApply Cisco's security patches for both affected FTD and FMC deployments; restrict administrative access and monitor for unauthorized expert mode usage as interim controls.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Secure Firewall Management CenterApplication
Affected:>= 6.2.3, <= 6.2.3.18>= 6.4.0, <= 6.4.0.16>= 6.6.0, <= 6.6.7.1>= 7.0.0, <= 7.0.5>= 7.1.0, <= 7.1.0.3>= 7.3.0, <= 7.3.1.1
Secure Firewall Threat DefenseApplication
Affected:>= 6.2.3, <= 6.2.3.18>= 6.4.0, <= 6.4.0.17>= 6.6.0, <= 6.6.7.1>= 6.7.0, <= 6.7.0.3>= 7.0.0, <= 7.0.5>= 7.1.0, <= 7.1.0.3>= 7.2.0, <= 7.2.3

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed Cisco security product
    Run 'show version' on the device or check the web interface under System > About to determine if Cisco Firepower Threat Defense (FTD) or Cisco Secure Firewall Management Center (FMC) is deployed
    Affected if The device runs either FTD or FMC software
  2. Check FTD version against affected ranges
    Run 'show version' on the FTD device or check the web interface. Compare the displayed version number to these affected ranges: 6.2.3 through 6.2.3.18, 6.4.0 through 6.4.0.17, 6.6.0 through 6.6.7.1, 6.7.0 through 6.7.0.3, 7.0.0 through 7.0.5, 7.1.0 through 7.1.0.3, or 7.2.0 through 7.2.3
    Affected if The installed FTD version falls within any of the listed affected version ranges
  3. Check FMC version against affected ranges
    Run 'show version' on the FMC device or check the web interface. Compare the displayed version number to these affected ranges: 6.2.3 through 6.2.3.18, 6.4.0 through 6.4.0.16, 6.6.0 through 6.6.7.1, 7.0.0 through 7.0.5, 7.1.0 through 7.1.0.3, or 7.3.0 through 7.3.1.1
    Affected if The installed FMC version falls within any of the listed affected version ranges
  4. Verify FTD-FMC communication is configured
    On FTD, run 'show managers' to confirm it is registered to an FMC. On FMC, verify under System > Integration > Physical Devices that FTD devices are added and actively communicating
    Affected if FTD is registered to and communicating with FMC (the attack exploits this inter-device channel)
  5. Confirm expert mode is accessible
    Check if expert mode CLI access is enabled on the device. On FTD, expert mode is available via 'expert' command from the CLI. Verify administrative access controls allow authorized admins to reach expert mode
    Affected if Expert mode is accessible to authenticated administrators (the vulnerability is exploited through expert mode)

Your environment is affected if you run any FTD or FMC version within the specified ranges AND have FTD-FMC communication configured with expert mode accessible to administrators.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 7.3.1.1
Interim mitigation

Apply Cisco's security patches for both affected FTD and FMC deployments; restrict administrative access and monitor for unauthorized expert mode usage as interim controls.

Recommended fix High confidence

FTD: 6.2.3.19+, 6.4.0.18+, 6.6.7.2+, 6.7.0.4+ | FMC: 6.2.3.19+, 6.4.0.17+, 6.6.7.2+, 7.0.6+

  1. 1. Identify the exact version of Cisco FTD and FMC software currently installed on affected devices using 'show version' command.
  2. 2. For FTD devices: If running 6.2.3.x, upgrade to 6.2.3.19 or later; if running 6.4.0.x, upgrade to 6.4.0.18 or later; if running 6.6.0.x, upgrade to 6.6.7.2 or later; if running 6.7.0.x, upgrade to 6.7.0.4 or later.
  3. 3. For FMC devices: If running 6.2.3.x, upgrade to 6.2.3.19 or later; if running 6.4.0.x, upgrade to 6.4.0.17 or later; if running 6.6.0.x, upgrade to 6.6.7.2 or later; if running 7.0.0-7.0.5, upgrade to 7.0.6 or later.
  4. 4. Download the appropriate software upgrade from the Cisco Software Download center (software.cisco.com).
  5. 5. Review the Cisco FTD and FMC upgrade guides for proper upgrade procedures, including backup and compatibility checks.
  6. 6. Plan maintenance window as upgrades may require device downtime.
  7. 7. After upgrade, verify the new version is installed and test that the inter-device communication between FTD and FMC functions correctly.
Caveat Software upgrades may require compatibility checks between FTD and FMC versions; ensure paired devices run compatible versions post-upgrade

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Secure Firewall Management Center Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-20063 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-20063 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data