CVE-2022-20729
Cisco Firepower Threat Defense Software XML Injection Vulnerability
- Published
- Updated
- Reserved
- Assigned by
- cisco
Description
A vulnerability in CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands. A successful exploit could allow the attacker to inject XML into the command parser, which could result in unexpected processing of the command and unexpected command output.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ciscoCNA (assigner) | 3.1 | Medium4.4 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.27% · top 81% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.4.
Weakness
Affected products
Cisco · Cisco Firepower Threat Defense Software
- affected n/a
What to do
Exploitation: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
References (1)
- 20220427 Cisco Firepower Threat Defense Software XML Injection Vulnerability (opens in a new tab)vendor-advisoryx_refsource_CISCOx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-20729)Record last updated .