CVE-2017-3806 Cisco CVE debrief

Who should care

Administrators and security teams responsible for Cisco Firepower 4100/9300 appliances and Firepower Threat Defense deployments should review this issue, especially where local administrative access is available or where CLI access is exposed to trusted but non-fully-trusted operators.

Technical summary

The vulnerability is described as a flaw in CLI command processing that allows command injection. The attacker model in the supplied CVSS vector is local, low-privilege authenticated access (AV:L/PR:L), with no user interaction required. NVD maps the weakness to CWE-78 and lists vulnerable Firepower Threat Defense versions 5.3.0, 5.4.0, 6.0.0, 6.0.1, and 6.1.0. The supplied Cisco advisory metadata also names known affected release 2.0(1.68) and fixed releases 2.0(1.118), 2.1(1.47), 92.1(1.1646), 92.1(1.1763), and 92.2(1.101).

Defensive priority

Medium. The issue requires authenticated local access, but successful exploitation can still lead to arbitrary command execution on the appliance. Treat as a meaningful administrative-plane risk and prioritize remediation on exposed or multi-operator systems.

Recommended defensive actions

• Confirm whether Cisco Firepower 4100 Series or Cisco Firepower 9300 appliances are in use.
• Check installed Firepower Threat Defense or appliance release versions against the affected and fixed versions in the Cisco advisory and NVD record.
• Apply the vendor-fixed release identified for your branch as soon as operationally feasible.
• Restrict and monitor local CLI access to trusted administrators only.
• Review administrative access logs for unexpected CLI activity around the affected period.
• Track Cisco security advisories and NVD entries for any updates or clarifications related to this CVE.

Evidence notes

All claims are limited to the supplied CVE record and linked references. The CVE description states the vulnerability affects Cisco Firepower 4100 Series Next-Generation Firewall and Cisco Firepower 9300 Security Appliance, and that an authenticated local attacker can inject arbitrary shell commands. The NVD data supplied maps the weakness to CWE-78 and lists Firepower Threat Defense versions 5.3.0 through 6.1.0 as vulnerable. The supplied Cisco advisory reference provides the vendor source, while the SecurityFocus link is a third-party advisory/VDB entry. No KEV entry is present in the supplied data.

Official resources