Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Command Injection Vulnerability

🚨SEVERITY: MEDIUM — CVSS 6.0Security Advisory

TL;DR 📌

  • A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. This vulnerability is due to improper input validation for specific CLI commands. An attacker could exploit this…
  • Highest CVSS: 6.0 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20220.

What it is

CVE-2025-20220 is a command injection flaw in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Secure Firewall Threat Defense (FTD) Software. The problem is improper input validation for specific CLI commands, which lets an attacker inject operating system commands into a legitimate one.

Exploitation requires valid Administrator credentials — this is not remotely exploitable by an unauthenticated party. The access path is local, through the device CLI, not the data plane or an unauthenticated management interface.

The practical impact depends on deployment. On most systems, Administrator accounts already have expert-mode access to the underlying operating system, so exploiting this flaw gains an attacker nothing they didn’t already have. It matters where expert mode is deliberately restricted — for example, multi-instance deployments, or systems configured with the system lockdown-sensor command. In those cases, a successful exploit lets an authenticated Administrator escape the restricted CLI prompt and execute arbitrary commands on the underlying OS as root, regaining access that the lockdown was meant to prevent.

Cisco Secure Firewall ASA Software is confirmed not affected. Cisco’s PSIRT states it is not aware of any public announcements or malicious use of this vulnerability.

What to do

  • Check whether you rely on system lockdown-sensor or multi-instance FMC/FTD deployments to restrict Administrator access to expert mode. If so, treat this as the scenario where the flaw actually removes an intended control.
  • Use the Cisco Software Checker against your running FMC and FTD releases to identify the “First Fixed” version for this advisory (cisco-sa-fmc-ftd-cmdinj-PhE7kmT); Cisco has released software updates and there are no workarounds.
  • Plan upgrades through the standard Secure FMC upgrade guide, and confirm hardware/software compatibility before upgrading.
  • Review who holds Administrator credentials on affected FMC/FTD systems — since exploitation requires valid Administrator access, tightening credential issuance and rotation reduces exposure even before patching.
  • No action needed for Cisco Secure Firewall ASA Software; Cisco has confirmed it is not affected.

For leadership 🧭

Executive summary. This flaw only matters where you’ve deliberately restricted Administrator access to expert mode, such as multi-instance deployments or systems using lockdown-sensor; there it lets an Administrator regain root OS access that the lockdown was meant to block. It can be handled through the normal patch cycle rather than as an emergency, since exploitation needs valid Administrator credentials and Cisco knows of no public exploitation.

Why it matters:

  • On FMC and FTD systems configured with system lockdown-sensor or in multi-instance deployments, this flaw removes the intended restriction and hands an Administrator root access to the underlying operating system.
  • On most other deployments, Administrator accounts already have expert-mode OS access by default, so exploiting this flaw gains an attacker nothing beyond what they already hold.
  • The access path is local through the device CLI, not the data plane or an unauthenticated management interface, so it cannot be triggered without valid Administrator credentials.
  • Cisco Secure Firewall ASA Software is confirmed not affected, so no action is needed on ASA estate.

Now / Next / Later:

  • Now: Identify which FMC and FTD systems in your estate use system lockdown-sensor or multi-instance deployments to restrict Administrator access to expert mode — these are the ones where this flaw actually matters.
  • Next: Run the Cisco Software Checker against your FMC and FTD releases against advisory cisco-sa-fmc-ftd-cmdinj-PhE7kmT to find the First Fixed version, and schedule the upgrade via the standard Secure FMC upgrade guide after confirming hardware/software compatibility.
  • Later: Review and tighten who holds Administrator credentials on FMC and FTD systems, since exploitation depends entirely on valid Administrator access, and treat lockdown-sensor configurations as needing prompt patch follow-through going forward.

Source