---
id: CVE-2020-3549
title: >-
  A vulnerability in the sftunnel functionality of Cisco Firepower Management
  Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could
  allow an unauthenticated, remote attacker to obtain the device registration
  hash
summary: >-
  A vulnerability in the sftunnel functionality of Cisco Firepower Management
  Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could
  allow an unauthenticated, remote attacker to obtain the device registration
  hash. T…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-326
  - CWE-326
vendor: cisco
product: secure_firewall_management_center
affected:
  - secure_firewall_management_center < 6.6.1
  - secure_firewall_threat_defense < 6.6.1
patched:
  - secure_firewall_management_center 6.6.1
  - secure_firewall_threat_defense 6.6.1
published: '2020-10-21'
updated: '2026-08-11'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-3549'
references:
  - url: >-
      https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdfmc-sft-mitm-tc8AzFs2
    label: psirt@cisco.com
  - url: >-
      https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdfmc-sft-mitm-tc8AzFs2
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00951
epssPercentile: 0.59209
ingestedAt: '2026-08-11T19:48:28.708Z'
---

## Overview

A vulnerability in the sftunnel functionality of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to obtain the device registration hash. The vulnerability is due to insufficient sftunnel negotiation protection during initial device registration. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a specific flow of the sftunnel communication between an FMC device and an FTD device. A successful exploit could allow the attacker to decrypt and modify the sftunnel communication between FMC and FTD devices, allowing the attacker to modify configuration data sent from an FMC device to an FTD device or alert data sent from an FTD device to an FMC device.

## Affected

- `secure_firewall_management_center < 6.6.1`
- `secure_firewall_threat_defense < 6.6.1`

## Remediation

Upgrade past the affected range:

- `secure_firewall_management_center 6.6.1`
- `secure_firewall_threat_defense 6.6.1`