Cisco has issued security patches to fix a maximum-severity vulnerability in its Secure Firewall Management Center (FMC) Software that could allow remote attackers to execute arbitrary code on affected systems.
The flaw, tracked as CVE-2025-20265 with a CVSS score of 10.0, exists in the RADIUS subsystem and stems from improper handling of user input during the authentication phase. This weakness could enable an unauthenticated, remote attacker to inject malicious shell commands, executed with high-level privileges.
According to Cisco, successful exploitation requires that FMC is configured for RADIUS authentication via its web-based management interface, SSH management, or both.
Impacted Versions:
- Cisco Secure FMC Software releases 7.0.7 and 7.7.0 (with RADIUS authentication enabled).
- No other Cisco products are affected.
There are no workarounds apart from applying the official patch. The vulnerability was discovered during Cisco’s internal security testing by Brandon Sakai.
Other High-Severity Vulnerabilities Addressed
Alongside CVE-2025-20265, Cisco has fixed several high-severity flaws, including:
- CVE-2025-20217: Snort 3 DoS Vulnerability (CVSS 8.6)
- CVE-2025-20222: IPv6 over IPsec DoS Vulnerability (CVSS 8.6)
- CVE-2025-20224, CVE-2025-20225, CVE-2025-20239: IKEv2 DoS Vulnerabilities (CVSS 8.6)
- CVE-2025-20133, CVE-2025-20243: SSL VPN DoS Vulnerabilities (CVSS 8.6)
- CVE-2025-20134: SSL/TLS Certificate DoS Vulnerability (CVSS 8.6)
- CVE-2025-20136: NAT DNS Inspection DoS Vulnerability (CVSS 8.6)
- CVE-2025-20263: Web Services DoS Vulnerability (CVSS 8.6)
- CVE-2025-20148: HTML Injection Vulnerability (CVSS 8.5)
- CVE-2025-20251: VPN Web Server DoS Vulnerability (CVSS 8.5)
- CVE-2025-20127: TLS 1.3 Cipher DoS Vulnerability (CVSS 7.7)
- CVE-2025-20244: Remote Access VPN Web Server DoS Vulnerability (CVSS 7.7)
Although none of these vulnerabilities are known to be exploited in the wild, Cisco strongly advises immediate updates due to the ongoing targeting of network appliances.
Mitigation Strategies
While the official recommendation is to apply Cisco’s patches immediately, organizations can also take additional steps to reduce potential exposure:
- Disable RADIUS Authentication (if not business-critical):
- Switch to local user accounts, LDAP authentication, or SAML single sign-on (SSO) until patches are applied.
- Restrict Management Access:
- Limit FMC access to trusted IP addresses or management networks only.
- Disable SSH and web-based access from untrusted networks.
- Enable Network Segmentation:
- Isolate FMC systems from the public internet and untrusted zones.
- Increase Monitoring & Logging:
- Review RADIUS authentication logs for suspicious activity.
- Monitor for unauthorized configuration changes.
- Test in a Controlled Environment:
- Before applying patch, verify its impact in a lab or staging environment to avoid disruptions.
References: