Cisco disclosed **CVE-2025-20265**, a **critical (CVSS 10.0) remote code execution (RCE) vulnerability** in its **Secure Firewall Management Center (FMC) Software**, affecting versions **7.0.7 and 7.7.0** when **RADIUS authentication** is enabled. The flaw stems from **improper input validation** during RADIUS credential processing, allowing **unauthenticated attackers** to inject and execute **arbitrary shell commands with high-level privileges** remotely. No authentication or user interaction is required, making it highly exploitable.The vulnerability poses a **severe risk** as it enables full system compromise, potentially leading to **lateral movement, data exfiltration, or complete takeover of firewall management infrastructure**. While no **public exploitation** has been reported yet, the lack of workarounds (beyond disabling RADIUS) and the **critical severity** demand **immediate patching**. Cisco has released fixes but warns that mitigation requires **disabling RADIUS**, which may disrupt operational workflows.The flaw was discovered internally, underscoring the **proactive threat** of unpatched enterprise firewall systems. Organizations failing to patch risk **catastrophic breaches**, including **unauthorized access to sensitive networks, credential theft, or downstream attacks on connected systems**.
Source: https://cybersecuritynews.com/cisco-secure-firewall-vulnerability/
TPRM report: https://www.rankiteo.com/company/cisco
"id": "cis751081525",
"linkid": "cisco",
"type": "Vulnerability",
"date": "8/2025",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization’s existence"{'affected_entities': [{'industry': ['Networking Hardware', 'Cybersecurity'],
'location': 'San Jose, California, USA',
'name': 'Cisco Systems, Inc.',
'size': 'Large Enterprise',
'type': 'Corporation'}],
'attack_vector': ['Network',
'RADIUS Authentication Exploitation',
'Unauthenticated'],
'customer_advisories': ['Customers using Cisco Secure FMC with RADIUS enabled '
'should apply updates or disable RADIUS immediately.'],
'date_publicly_disclosed': 'August 2025',
'description': 'Cisco has disclosed a critical security vulnerability '
'(CVE-2025-20265, CVSS 10.0) in its Secure Firewall Management '
'Center (FMC) Software, allowing unauthenticated attackers to '
'execute arbitrary shell commands with high-level privileges '
'remotely. The flaw resides in the RADIUS subsystem during the '
'authentication phase, where improper input validation enables '
'command injection via specially crafted credentials. No '
'authentication is required, and exploitation is possible over '
'the network. Affected versions include Cisco Secure FMC '
'Software 7.0.7 and 7.7.0 when RADIUS authentication is '
'enabled. No workarounds exist; patching or disabling RADIUS '
'authentication (switching to LDAP/SAML/local accounts) are '
'the only mitigations. Cisco has released free updates and '
'urges immediate action. No public exploitation has been '
'reported.',
'impact': {'brand_reputation_impact': ['High (critical vulnerability in '
'enterprise firewall infrastructure)'],
'operational_impact': ['Potential disruption if RADIUS '
'authentication is disabled (requires '
'reconfiguration to LDAP/SAML/local '
'accounts)',
'Emergency patching may require maintenance '
'windows'],
'systems_affected': ['Cisco Secure Firewall Management Center '
'(FMC) Software (versions 7.0.7, 7.7.0 with '
'RADIUS enabled)']},
'investigation_status': 'Disclosed; No public exploitation reported. Internal '
'discovery by Cisco.',
'lessons_learned': ['Proactive internal security testing can uncover critical '
'vulnerabilities before exploitation (discovered by '
'Brandon Sakai of Cisco).',
'Vulnerabilities in authentication systems (e.g., RADIUS) '
'can have severe impacts if input validation is '
'insufficient.',
'Lack of workarounds for critical flaws underscores the '
'importance of patch management and alternative '
'mitigation strategies (e.g., disabling vulnerable '
'features).'],
'post_incident_analysis': {'corrective_actions': ['Released patched software '
'versions.',
'Recommended disabling '
'RADIUS authentication as a '
'temporary mitigation.'],
'root_causes': ['Insufficient input validation in '
'RADIUS authentication subsystem.',
'Improper handling of '
'user-supplied credentials during '
'authentication.']},
'recommendations': ['Immediately patch affected Cisco Secure FMC Software '
'(versions 7.0.7, 7.7.0) to the latest release.',
'Disable RADIUS authentication if patching is not '
'immediately feasible, and switch to LDAP, SAML SSO, or '
'local accounts.',
"Prioritize this vulnerability as a 'priority-one' "
'patching scenario due to its critical severity (CVSS '
'10.0) and potential for unauthenticated remote code '
'execution.',
'Conduct a review of all authentication mechanisms in '
'enterprise firewall infrastructure to identify similar '
'input validation risks.',
'Monitor for unusual authentication attempts or command '
'execution on FMC systems until patches are applied.'],
'references': [{'date_accessed': 'August 2025',
'source': 'Cisco Security Advisory: CVE-2025-20265',
'url': 'https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-KLJ98X7Q'},
{'date_accessed': 'August 2025',
'source': 'Cisco August 2025 Semiannual Security Advisory '
'Bundled Publication',
'url': 'https://sec.cloudapps.cisco.com/security/center/publicationListing.x'}],
'response': {'communication_strategy': ['Public advisory via Cisco’s August '
'2025 Semiannual Security Advisory '
'Bundled Publication',
'Urgent recommendation for immediate '
'patching'],
'containment_measures': ['Disable RADIUS authentication (switch '
'to LDAP/SAML/local accounts)'],
'incident_response_plan_activated': True,
'remediation_measures': ['Apply free software updates provided '
'by Cisco']},
'stakeholder_advisories': ['Urgent patching recommended for all affected '
'organizations.'],
'title': 'Critical Remote Code Execution Vulnerability in Cisco Secure '
'Firewall Management Center (FMC) Software (CVE-2025-20265)',
'type': ['Vulnerability Disclosure',
'Remote Code Execution (RCE)',
'Command Injection'],
'vulnerability_exploited': {'affected_versions': ['7.0.7', '7.7.0'],
'component': 'RADIUS Subsystem (Authentication '
'Phase)',
'cve_id': 'CVE-2025-20265',
'cvss_score': 10.0,
'prerequisites': ['RADIUS authentication enabled '
'for web/SSH management'],
'root_cause': 'Insufficient Input Validation'}}