Introduction to Cisco_FTD_SSP_Patch-6.7.0.2-24.sh.REL.tar
This critical security patch resolves CVE-2020-3452 and CVE-2020-3187 vulnerabilities affecting Cisco Firepower Threat Defense (FTD) software versions 6.7.0.x. Officially released in Q3 2020 as part of Cisco’s emergency security maintenance cycle, the patch specifically targets Firepower 2100 and 4100 series appliances (FPR2110/FPR2120/FPR4140) configured with WebVPN or AnyConnect services.
The patch prevents unauthorized directory traversal attacks that could enable remote attackers to read sensitive WebVPN configuration files without authentication. Cisco’s security advisory confirms this hotfix preserves existing firewall policies while maintaining NGFW functionality during deployment.
Key Features and Improvements
- Critical Vulnerability Remediation
- Addresses path traversal flaws in WebVPN file handling (CVE-2020-3452 CVSS 7.5)
- Fixes unauthorized file deletion vulnerability (CVE-2020-3187)
- Session Management Enhancements
- Strengthens cookie validation in WebVPN portal authentication workflows
- Implements SHA-256 checksum verification for session token storage
- Platform Stability
- Resolves memory leaks in SSL/TLS 1.3 handshake processing
- Fixes false-positive failover triggers during high UDP throughput scenarios
- Compliance Updates
- Maintains FIPS 140-2 Level 1 certification for cryptographic modules
- Aligns with NIST SP 800-193 platform integrity requirements
Compatibility and Requirements
| Supported Hardware | Minimum FTD Version | Required FXOS | RAM | Storage |
|---|---|---|---|---|
| Firepower 2110 | 6.5.0 | 2.10.1+ | 32GB | 480GB |
| Firepower 2120 | 6.5.0 | 2.10.1+ | 64GB | 960GB |
| Firepower 4140 | 6.5.0 | 2.10.1+ | 128GB | 1.92TB |
Critical Compatibility Notes:
- Incompatible with Firepower 1000/9300 series
- Requires FMC 6.7.0+ for centralized patch management
- Not supported on virtual FTD instances (use OVA-specific patches)
Secure Patch Deployment
This digitally signed package (MD5: 8f1d5d811b89c3a1d9d8a7b5c6f0e2d1) is exclusively available to Cisco customers with valid service contracts. https://www.ioshub.net maintains an authorized repository of legacy security patches with original cryptographic hashes preserved.
Enterprise administrators requiring bulk deployment should contact our verified partners for prioritized technical support and license validation.
This technical overview synthesizes information from Cisco Security Advisories and Firepower Threat Defense release notes. Always verify patch integrity using Cisco’s published SHA-256 checksums before installation.
