Is CVE-2024-20472 being actively exploited?

CVE-2024-20472 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2024-20472?

CVE-2024-20472 has a CVSS 3.1 base score of 6.5 (MEDIUM).

CVE-2024-20472

MEDIUM · CVSS 6.5EPSS 0.4%EU EUVD

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not validate user input adequately. An attacker could exploit this vulnerability by authenticating to the application as an Administrator and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to obtain unauthorized data from the database and make changes to the system. To exploit this vulnerability, an attacker would need Administrator-level privileges.

Key facts

CVSS score: 6.5 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-89
EPSS score: 0.4% (37th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2024-18187)
Published: October 23, 2024
NVD last modified: June 17, 2026
Status: Analyzed

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2024-18187 in the EU Vulnerability Database. Last updated in EUVD on October 23, 2024.

View on the EU Vulnerability Database

Affected products

cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Cisco Secure Firewall Threat Defense (FTD) 7.4 with Secure Firewall Management Center (FMC) 7.4 and Secure Client 5.1 - Cisco Systems, Inc. - Common Criteria NSCIB-CC-2400046-01-CR - active

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sql-inj-LOYAFcfq(Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain