OTPulse

Cisco Secure Firewall Management Center Software sftunnel Root Arbitrary Code Execution Vulnerability

Plan PatchCVSS 9.9cisco-sa-fmc-sftunn-codex-c3O4Jft2Sep 16, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center Software allows an authenticated, remote attacker to execute arbitrary commands as root. A registered sftunnel peer has incorrect permissions to write an arbitrary file to any location on the device. An attacker with valid credentials can hijack the sftunnel connection or send a malicious sftunnel command to write a file to disk that executes with root privileges, allowing full compromise of the FMC and all managed firewall devices.

What this means
What could happen
An authenticated attacker with valid user credentials can hijack the inter-device communication channel on your Secure Firewall Management Center and execute arbitrary commands as root, potentially taking full control of the device and all managed firewalls.
Who's at risk
Operators of Cisco Secure Firewall Management Center appliances managing distributed firewall deployments. This impacts any organization using FMC as a central management platform for Cisco Secure Firewall devices, regardless of industry, as compromise of the management center could disrupt network security controls across the entire deployment.
How it could be exploited
An attacker with valid credentials on the FMC initiates or hijacks an sftunnel peer connection, then sends a malicious sftunnel command that writes a file to disk with root execution permissions. The attacker can execute arbitrary commands by triggering execution of the written file, gaining complete control of the management center.
Prerequisites
  • Valid user credentials on the Secure Firewall Management Center
  • Network access to the FMC sftunnel inter-device communication port
  • Ability to establish or hijack an sftunnel peer connection to the FMC
remotely exploitablerequires valid credentialslow complexity attackhigh CVSS score (9.9)affects critical infrastructure management system
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
Secure Firewall Management Center (FMC) AppliancesAll versionsFix available
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDRestrict network access to sftunnel inter-device communication ports to only authorized firewall appliances
HARDENINGEnforce strong authentication on user accounts with access to the FMC to prevent credential compromise
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Secure Firewall Management Center to the patched version released by Cisco
Long-term hardening
0/1
HARDENINGMonitor FMC logs for suspicious sftunnel peer connection attempts or file write activities
View full vendor advisory
API: /api/v1/advisories/11737c2b-7f66-469b-ab50-570bfe96d087

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.