Cisco Secure Firewall Management Center Software Authorization Bypass Vulnerabilities

🚨SEVERITY: MEDIUM — CVSS 6.5Security Advisory

TL;DR 📌

  • Multiple vulnerabilities in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to access files that they are not authorized to access. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Cisco has released software updates that address these vulnerabilities. There…
  • Highest CVSS: 6.5 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20301, CVE-2025-20302.

What it is

Two separate authorisation bypass flaws sit in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, both affecting deployments configured for multitenancy using domains. Neither vulnerability depends on the other, and a release fixed for one may still be exposed to the other.

CVE-2025-20301 concerns troubleshoot file access. An authenticated, low-privileged, remote attacker can directly access a troubleshoot file belonging to a different domain on the same FMC instance, due to missing authorization checks. This gives access to sensitive information contained in that file. It carries a CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) — high confidentiality impact, no effect on integrity or availability.

CVE-2025-20302 is the same class of flaw applied to generated reports: an authenticated, low-privileged, remote attacker can retrieve a report generated for a different domain than the one they’re authorised to, again via missing authorization checks. This lets an attacker read activity recorded in that other domain. It scores 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) — lower confidentiality impact than the troubleshoot file bypass.

Both require an authenticated session with low privileges on the FMC’s web management interface — this is a management-plane issue, not something reachable by an unauthenticated attacker or via the data plane. Cisco has confirmed that Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software are not affected; the exposure is specific to FMC.

What to do

  • Check whether your FMC deployment uses multitenancy with domains (Domain Management chapter of the FMC Configuration Guide covers how to confirm this). If domains aren’t in use, exposure to these two issues doesn’t apply.
  • There are no workarounds for either CVE — the only remediation is upgrading FMC software. Use the Cisco Software Checker to identify the “First Fixed” release for your current version against this advisory (cisco-sa-fmc-authz-bypass-M7xhnAu).
  • Since low-privileged authenticated users can trigger both issues, review who holds accounts on multi-domain FMC instances and tighten access where domain separation matters for confidentiality of troubleshoot files and reports.
  • This advisory is part of Cisco’s August 2025 bundled Secure Firewall publication — worth checking the other advisories in that bundle if you run ASA or FTD alongside FMC, in case separate issues apply to those products.

For leadership 🧭

Executive summary. Any organisation running Cisco Secure FMC with multitenancy domains enabled has two separate paths for a logged-in, low-privileged user to read troubleshoot files or reports belonging to other domains they shouldn’t have access to. There’s no workaround, so this needs an upgrade scheduled rather than an urgent emergency patch given the medium severity and lack of known exploitation.

Why it matters:

  • Troubleshoot files on FMC can contain sensitive diagnostic data; CVE-2025-20301 lets a low-privileged authenticated user pull another domain’s troubleshoot file directly, scoring 6.5 for high confidentiality impact.
  • CVE-2025-20302 lets the same class of user retrieve generated reports from a different domain, exposing recorded activity from that domain to someone who shouldn’t see it.
  • Both flaws require only an authenticated, low-privileged session on FMC’s web management interface — no special access or unauthenticated route is needed, so any existing account with domain access is a potential vector.
  • Cisco has confirmed ASA and FTD are not affected; the exposure is isolated to FMC instances configured for multitenancy using domains, so single-domain deployments are out of scope.

Now / Next / Later:

  • Now: Confirm whether your FMC instance is configured for multitenancy using domains (via the Domain Management section of the FMC Configuration Guide) — if it isn’t, these two issues don’t apply to you.
  • Next: For multi-domain FMC deployments, use the Cisco Software Checker against this advisory to find the First Fixed release and schedule the upgrade, since no workaround exists for either CVE.
  • Later: Review account and privilege assignments across domains on shared FMC instances so domain separation for troubleshoot files and reports is enforced by policy as well as by software fix.

Source