CVE-2015-6380: An unspecified script in the web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Fir...

Security readout for executives and security teams

CVE-2015-6380 is a command-injection flaw in the Cisco Firepower 9000 web interface. An authenticated remote user could cause the appliance to run arbitrary operating system commands through crafted parameters. That could put a security appliance itself at risk if vulnerable FXOS versions remain deployed. Exposure appears limited to Cisco Firepower 9000 devices running Firepower Extensible Operating System 1.1(1.160), especially where the administrative web interface is reachable by authenticated users. The source bundle does not identify other affected products or versions. Treat confirmed exposure as high priority because the vulnerable component is a security appliance and the impact is OS command execution. Urgency is lower where management access is tightly restricted and accounts are controlled. Mitigation focus: Check Cisco advisory cisco-sa-20151123-fire for fixed releases or official mitigations.; Restrict Firepower 9000 web interface access to trusted management networks.; Remove unnecessary web-interface accounts and review privileged user access..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.