A flaw in the sftunnel inter‑device communication protocol of Cisco Secure Firewall Management Center allows an authenticated remote attacker to write an arbitrary file to any location on the device. By sending a specially crafted sftunnel command, the attacker can store a malicious file that is later executed with root privileges, effectively enabling remote code execution as root.

The vulnerability applies to Cisco Secure Firewall Management Center (FMC). No specific firmware or software version information is provided in the CVE entry; users should consult the Cisco advisory linked in the references to confirm whether their deployments are affected.

The CVSS score of 9.9 indicates very high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, but the flaw can only be leveraged by users possessing valid credentials and by hijacking or constructing a sftunnel connection. The vulnerability is not listed in the CISA KEV catalog. Abuse of this weakness, identified as CWE‑862, would allow an attacker to bypass permission checks and gain root-level code execution, which would be a critical incident if an exploit succeeds.