Description

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists because a registered sftunnel peer has incorrect permissions to write an arbitrary file to any location on the device. An attacker could exploit this vulnerability by hijacking the sftunnel communication connection or being a valid registered sftunnel peer and sending an sftunnel command to write a malicious file to the disk of an affected device. A successful exploit could allow the attacker to write a file to the device that is executed with root privileges. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-16T20:17:23.180Z",
  "pubdate": "2026-09-16T20:17:23.180Z",
  "executiveSummary": "This vulnerability involves an improper privilege management flaw within the sftunnel inter-device communication protocol used by Cisco Secure Firewall Management Center (FMC) Software.\nThe vulnerability allows an authenticated, remote attacker to perform an arbitrary file write operation on the underlying filesystem of an affected device.\nBy leveraging a registered sftunnel peer session, an attacker can overwrite or create files in restricted locations, ultimately leading to arbitrary command execution with root privileges.\nThe risk implication is critical, as successful exploitation results in full system compromise.\nExploitation requirements are stringent, necessitating that the attacker possesses valid user credentials on the affected device and maintains an active or hijackable sftunnel communication connection.\nThe vulnerability represents a significant security failure in trust boundaries between registered peers, allowing a breach of the principle of least privilege.",
  "technicalDetails": "The core of this vulnerability lies in the improper permission validation logic within the sftunnel protocol implementation. The sftunnel service is designed to facilitate secure communication and management synchronization between Cisco devices, such as the FMC and managed firewalls.\nThe root cause is an insecure file write primitive exposed through the sftunnel interface. While the protocol requires peer authentication for legitimate management functions, the design fails to enforce adequate filesystem path restrictions on incoming management commands. Specifically, the service accepts commands that translate into file write operations without sufficient sanitization or validation of the destination directory.\nThe attack flow begins with the adversary establishing a position as a valid registered sftunnel peer or hijacking an existing, authenticated session. Once authenticated, the attacker issues a specially crafted sftunnel command designed to trigger the file write functionality. Because the sftunnel daemon operates with elevated privileges, the file write operation is performed with root-level access permissions.\nThe attacker can target sensitive system directories to write a malicious payload. Common exploitation vectors involve overwriting configuration files, binary executables, or cron job scripts that are periodically executed by the system. By injecting malicious code into these target files, the attacker ensures that the payload is executed by the system's runtime environment or a scheduled task with root privileges.\nThe vulnerability is limited to authenticated actors, which significantly restricts the external attack surface; however, the impact is severe. Since the sftunnel protocol effectively bridges the management plane of the device, compromise of this component allows an attacker to bypass all OS-level access controls. Once the arbitrary file is written and subsequently executed, the attacker gains full control over the Cisco Secure Firewall Management Center.\nThe post-exploitation impact includes persistent backdoor installation, exfiltration of sensitive management data, and the ability to modify the security policies enforced by the FMC across the managed environment. The privilege escalation is inherent in the design of the daemon, as the service context itself runs with sufficient permissions to modify critical system files, thus providing the attacker with a direct escalation path to superuser access."
}