CVE-2024-20340

CVE-2024-20340 is an SQL injection vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software. An authenticated, remote attacker with specific administrative roles (Security Approver, Intrusion Admin, Access Admin, or Network Admin) can exploit this flaw. The vulnerability, rated Medium (CVSS 6.5), allows an attacker to read database contents and gain limited read access to the underlying operating system by sending a crafted HTTP request. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has received some community discussion and media coverage.