This vulnerability arises from insecure deserialization in the web-based management interface of Cisco Secure Firewall Management Center (FMC). An unauthenticated remote attacker can exploit this by sending a crafted serialized Java object, leading to arbitrary code execution with root privileges on the affected device. The vulnerability affects numerous explicitly listed versions of Cisco FMC. The attack surface is limited if the management interface is not exposed to the public internet. There is no patch or vendor advisory information provided regarding remediation status.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary Java code with root privileges on the affected Cisco FMC device, resulting in full system compromise. This includes complete confidentiality, integrity, and availability impact as indicated by the CVSS vector. The vulnerability poses a critical risk to affected systems, especially if the management interface is internet-facing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Cisco FMC web-based management interface to trusted networks only and avoid exposing it to the public internet to reduce the attack surface.