Cisco FMC static credential vulnerability exploited as a zero-day

Cisco dropped a nasty warning: hackers have been actively using a hidden built-in login problem in its Secure Firewall Management Center — the software companies use to manage their firewalls. In plain English, a stranger could get into the system with a low-level account and peek at sensitive information, and Cisco says this has already been happening in the wild. There’s no real workaround, only patches, which is exactly the kind of phrase that makes security teams spill coffee on themselves.

But the real fireworks were in the comments, where the community went straight for the jugular. The loudest joke? That putting “Secure” in the product name now feels “pretty brave,” especially for Cisco. That one practically wrote itself, and readers piled on with the kind of grim humor only tired IT admins can produce. Another hot thread asked the question everyone was thinking: why did this mystery account exist at all? Was it some leftover testing shortcut, an internal convenience that escaped into production, or something worse? That suspicion gave the whole story a whodunit vibe.

Then came the broader accusation: this isn’t a one-off, critics said, but part of a pattern. One commenter claimed Cisco has had a ton of static credential issues across its gear, turning the thread from “bad bug” into “company culture problem?” territory. Cisco has posted hot fixes and told customers to rotate passwords, keys, and certificates if they suspect trouble. The community verdict, though, was less “oops” and more how is this still happening?