CVE-2021-34761: 
Cisco Firepower Threat Defense (FTD) vulnerability analysis and mitigation

A vulnerability (CVE-2021-34761) was discovered in Cisco Firepower Threat Defense (FTD) Software that could allow an authenticated, local attacker with administrative privileges to overwrite or append arbitrary data to system files using root-level privileges. The vulnerability was first published on October 27, 2021, and was assigned a CVSS base score of 4.4 (Medium severity). The vulnerability affects multiple versions of Cisco FTD Software, with the default configuration being vulnerable (Cisco Advisory).

The vulnerability (CVE-2021-34761) stems from incomplete validation of user input for a specific CLI command in the Cisco FTD Software. It is classified under CWE-73 and has been assigned a CVSS v3.1 score of 4.4 with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:X/RL:X/RC:X. The vulnerability requires local access and high privileges for exploitation (Cisco Advisory).

A successful exploitation of this vulnerability could allow an attacker to overwrite or append arbitrary data to system files using root-level privileges. This could potentially lead to system compromise through file manipulation, though the attacker must already have administrative credentials on the device (Cisco Advisory).

Cisco has released software updates that address this vulnerability. There are no workarounds available. Fixed releases include version 6.4.0.13 for the 6.4.0 branch, 6.6.5 for the 6.6.0 branch, 6.7.0.3 for the 6.7.0 branch, 7.0.1 for the 7.0.0 branch, and 7.2.0.1 for version 7.2.0 and later. Users of earlier versions are advised to migrate to a supported release that includes the fix (Cisco Advisory).