A directory traversal flaw in the sftunnel component of Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) allows an authenticated admin to write arbitrary files with root privileges on the underlying operating system. The flaw arises from insufficient validation of directory paths during file synchronization, enabling an attacker to craft a path outside the intended location. By creating or replacing files, an attacker may install malware or alter system configuration, effectively achieving local privilege escalation and potentially executing arbitrary code on the host.

The vulnerability affects Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software. No specific affected versions are listed in the advisory; users should verify whether their deployed FMC/FTD instances are vulnerable or, if available, consult the vendor for patches.

With a CVSS score of 5.9 and an EPSS of less than 1%, the risk is moderate and the likelihood of exploitation is low, especially given that the attacker must possess authenticated administrative credentials. The vulnerability is not listed in the CISA KEV catalog. An attacker could exploit the flaw by logging into FMC/FTD, using the sftunnel feature to send a crafted path that resolves outside the intended directory, and writing arbitrary files—such as executable binaries or scripts—thereby achieving root-level access and arbitrary code execution on the underlying system.