This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco Secure Firewall Management Center Software warns of a critical vulnerability

Cisco reports a critical vulnerability in the Cisco Secure Firewall Management Center (FMC) Software product [1]. The availability of a fix can be verified using the Cisco Software Checker tool [2], followed by an upgrade to a fixed version according to the Cisco documentation [1]. If an immediate update is not possible, it is recommended, as a temporary risk mitigation, to disable RADIUS authentication and use a different login method.

Cisco Secure Firewall Management Center Software - RCE (CVE-2025-20265)
CVSS 10.0 (Critical)

An unauthenticated remote attacker, due to insufficient sanitization of user input during RADIUS authentication, is able to execute arbitrary shell commands with high privileges on the vulnerable device [1]. The vulnerability can be exploited only if RADIUS authentication is enabled on the instance for the administrative web and/or SSH interface.

The vulnerability is present in product:

  • Cisco Secure Firewall Management Center Software; ==7.7.0; ==7.0.7;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2025-20265 at cve.org, NVD
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 8. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 15. 8. 2025.

CESNET, z.s.p.o. Logo