CSCwa46963 - Security: CVE-2021-44228 -> Log4j 2 Vulnerability

[theerapongpomp]

Hi All,

Regarding CSCwa46963 mentioned the Log4j vulnerability with FTD managed by FDM.

I have a question if FTD managed by FMC only, it can be included to this?

Thanks in advance.

Nong.

[TheDan27]

Its classified as "not vulnerable" if managed by FMC:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

Vulnerable:

• Cisco Firepower Threat Defense (FTD) managed by Firepower Device Manager (FDM)

Not Vulnerable:

• Firepower Thread Defense (FTD) managed by Cisco Firepower Management Center
• Cisco Firepower Management Center

[othydojo]

@TheDan27Right, but FDM is dormant in the FTD, not gone. I guess this boils down to how is the vulnerability affecting the devices managed by FDM? If it's invoked specifically through the web server servicing the firewall, then I would safely assume that devices managed from FMC won't be affected due to the web server being "turned off" on the FTD? Can someone at Cisco confirm, please?