Cisco Secure Firewall Management Center Software Cross-Site Scripting Vulnerability

🚨SEVERITY: MEDIUM — CVSS 6.1Security Advisory

TL;DR 📌

  • A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability…
  • Highest CVSS: 6.1 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20235.

What it is

CVE-2025-20235 is a cross-site scripting vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software. The interface does not adequately validate user-supplied input in various data fields, which lets an attacker insert crafted input that is later rendered back to a user of the interface.

Exploitation requires an attacker to get a user to interact with crafted content (the CVSS vector shows UI:R — user interaction required — with an unauthenticated attacker over the network, AV:N/PR:N). A successful attack runs arbitrary script in the context of the FMC management interface, potentially exposing browser-based session data belonging to the victim user. This is a management-plane issue rather than a data-plane one; it targets the administrative web UI, not traffic handling.

Cisco has confirmed that Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software are not affected — this is specific to FMC. There are no workarounds. Cisco PSIRT states it is not aware of any public announcements or malicious use of this vulnerability.

This advisory is one of the entries in Cisco’s August 2025 semiannual bundled publication covering ASA, FMC and FTD software.

What to do

  • Identify all Cisco Secure FMC deployments in your environment and confirm the running software release.
  • Use the Cisco Software Checker against this advisory (or the full August 2025 bundled publication) to determine the “First Fixed” release for your specific FMC version, and upgrade to it — the advisory does not list a fixed release directly in this text, so run your version through the checker rather than guessing at a target build.
  • Since there is no workaround, treat upgrading as the only mitigation; there’s no interim configuration change to fall back on.
  • Given the attack requires user interaction, remind FMC administrators to be cautious with unsolicited links or content that could direct them to crafted input within the management interface, pending patching.
  • While planning the update, check the same bundled publication for other advisories affecting your ASA, FMC or FTD versions, so you can combine fixes into a single maintenance window using the “Combined First Fixed” output from the Software Checker.

For leadership 🧭

Executive summary. A cross-site scripting flaw in the Cisco Secure Firewall Management Center web interface could let an attacker capture session data from an administrator who is tricked into interacting with malicious content. There’s no workaround, so patching FMC on your normal change-window timeline is the only fix, though the medium severity and required user interaction mean this isn’t an emergency.

Why it matters:

  • The flaw sits in the FMC administrative web UI, not the ASA or FTD data plane, so it targets whoever manages your firewall policy rather than traffic passing through the firewall itself.
  • Because the attacker needs an admin to interact with crafted input, a phished or socially engineered FMC user is the realistic path in, not a blind network scan.
  • A successful attack runs script in the context of the management interface and can expose browser-based session information belonging to the logged-in administrator.
  • Cisco has confirmed ASA and FTD software are not affected, so exposure is limited to whichever FMC instances you run, with no interim workaround available.

Now / Next / Later:

  • Now: Identify every Cisco Secure FMC instance in your estate and note its current software release, and brief FMC administrators to be wary of unsolicited links or content within the management interface until patched.
  • Next: Run each FMC version through the Cisco Software Checker against this advisory to get the First Fixed release, then upgrade during your next maintenance window — check the same August 2025 bundle for other ASA/FMC/FTD advisories affecting your versions so you can apply a Combined First Fixed upgrade in one pass.
  • Later: Build FMC software checks into routine patch reviews of the semiannual Cisco Secure Firewall bundled advisories, since there is no workaround path here and timely upgrades are the only lasting mitigation for admin-interface XSS issues like this one.

Source