Introduction
Remote attackers can gain privileged shell access to Cisco Secure Firewall Management Center (FMC) Software by sending crafted credentials to the management interface or SSH. The vulnerability, CVE-2025-20265, affects enterprise environments that use centralized RADIUS authentication for administrative access. It has a CVSS score of 10.0, and the risk is severe for any unpatched deployment.
Cisco is a dominant vendor in enterprise networking and security. Its Secure Firewall Management Center (FMC) is the central platform for managing next-generation firewall and intrusion prevention deployments. FMC is widely used in large organizations and government networks, so a vulnerability in this product has an outsized impact.
Technical Information
CVE-2025-20265 is a command injection vulnerability in the RADIUS authentication subsystem of Cisco Secure Firewall Management Center (FMC) Software. The flaw comes from improper handling and sanitization of user input during authentication. When FMC is configured to use RADIUS to authenticate access to its web-based management interface or SSH, the software does not neutralize special elements, such as shell metacharacters, in user-supplied credentials.
An unauthenticated remote attacker can therefore submit crafted credentials that contain shell command sequences. The underlying operating system executes those commands with high privileges, which gives the attacker full control of the FMC device. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Key technical points:
- Exploitation does not require valid credentials, only network access to the affected management interface (web or SSH)
- The vulnerable code path is present only when RADIUS authentication is enabled for these interfaces
- The injected commands run with the privileges of the FMC process, typically root or equivalent
- The software does not validate user-supplied data before passing it to the shell
As of this writing, no public code snippets or detailed vulnerable code fragments have been released.
Patch Information
Cisco has released updated software versions that fix the command injection vulnerability in the Secure Firewall Management Center (FMC) Software. (sec.cloudapps.cisco.com) Users should upgrade to the latest fixed release listed in the advisory. Before upgrading, confirm that the device has enough memory and that the current hardware and software configuration is compatible with the new release. If you are unsure about any of this, contact the Cisco Technical Assistance Center (TAC) or your maintenance provider.
Affected Systems and Versions
- Cisco Secure Firewall Management Center (FMC) Software
- Only systems configured for RADIUS authentication for web-based management or SSH are vulnerable
- The Cisco advisory (cisco-sa-fmc-radius-rce-TNBKf79) lists the specific affected version ranges, fixed releases, and upgrade paths. Consult it for exact version details.
Vendor Security History
Cisco has had several critical vulnerabilities in Secure Firewall Management Center and related security products in recent years, including:
- Command injection vulnerabilities in FMC (see cisco-sa-fmc-cmd-inj-v3AWDqN7)
- Multiple remote code execution and authentication bypass flaws across the security product line
Cisco typically issues advisories and patches quickly after disclosure. The repeated input validation and command injection issues, though, point to ongoing problems with secure development and code review practices on Cisco's security product teams.
