---
id: CVE-2024-20482
title: >-
  A vulnerability in the web-based management interface of Cisco Secure Firewall
  Management Center (FMC) Software, formerly Firepower Management Center
  Software, could allow an authenticated, remote attacker to elevate privileges
  on an aff…
summary: >-
  A vulnerability in the web-based management interface of Cisco Secure Firewall
  Management Center (FMC) Software, formerly Firepower Management Center
  Software, could allow an authenticated, remote attacker to elevate privileges
  on an aff…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-863
vendor: cisco
product: secure_firewall_management_center
affected:
  - secure_firewall_management_center = 7.2.0
  - secure_firewall_management_center = 7.2.0.1
  - secure_firewall_management_center = 7.2.1
  - secure_firewall_management_center = 7.2.2
  - secure_firewall_management_center = 7.2.3
  - secure_firewall_management_center = 7.2.3.1
  - secure_firewall_management_center = 7.2.4
  - secure_firewall_management_center = 7.2.4.1
  - secure_firewall_management_center = 7.2.5
  - secure_firewall_management_center = 7.2.5.1
  - secure_firewall_management_center = 7.2.5.2
  - secure_firewall_management_center = 7.2.6
  - secure_firewall_management_center = 7.2.7
  - secure_firewall_management_center = 7.2.8
  - secure_firewall_management_center = 7.2.8.1
  - secure_firewall_management_center = 7.3.0
  - secure_firewall_management_center = 7.3.1
  - secure_firewall_management_center = 7.3.1.1
  - secure_firewall_management_center = 7.3.1.2
published: '2024-10-23'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:17:13.763'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-20482'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-priv-esc-CMQ4S6m7
    label: psirt@cisco.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-10-26T03:55:30.895507Z'
epss: 0.00492
epssPercentile: 0.42404
ingestedAt: '2026-11-05T06:38:03.580Z'
---

## Overview

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to elevate privileges on an affected device. To exploit this vulnerability, an attacker must have a valid account on the device that is configured with a custom read-only role.

 This vulnerability is due to insufficient validation of role permissions in part of the web-based management interface. An attacker could exploit this vulnerability by performing a write operation on the affected part of the web-based management interface. A successful exploit could allow the attacker to modify certain parts of the configuration.

## Affected

- `secure_firewall_management_center = 7.2.0`
- `secure_firewall_management_center = 7.2.0.1`
- `secure_firewall_management_center = 7.2.1`
- `secure_firewall_management_center = 7.2.2`
- `secure_firewall_management_center = 7.2.3`
- `secure_firewall_management_center = 7.2.3.1`
- `secure_firewall_management_center = 7.2.4`
- `secure_firewall_management_center = 7.2.4.1`
- `secure_firewall_management_center = 7.2.5`
- `secure_firewall_management_center = 7.2.5.1`
- `secure_firewall_management_center = 7.2.5.2`
- `secure_firewall_management_center = 7.2.6`
- `secure_firewall_management_center = 7.2.7`
- `secure_firewall_management_center = 7.2.8`
- `secure_firewall_management_center = 7.2.8.1`
- `secure_firewall_management_center = 7.3.0`
- `secure_firewall_management_center = 7.3.1`
- `secure_firewall_management_center = 7.3.1.1`
- `secure_firewall_management_center = 7.3.1.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.