Cisco Secure Firewall Management Center Software HTML Injection Vulnerability

🚨SEVERITY: HIGH — CVSS 8.5Security Advisory

TL;DR 📌

  • A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document. This vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by submitting malicious content to an affected device and…
  • Highest CVSS: 8.5 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20148.

What it is

CVE-2025-20148 is an HTML injection vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software. It sits in the code that generates device documents, and stems from improper validation of user-supplied data.

To exploit it, an attacker needs valid credentials for an account with at least the Security Analyst (Read Only) role — this is not an unauthenticated flaw. Using that access, the attacker submits malicious content that FMC later incorporates into a device-generated document. Because the injected HTML ends up in a document the system produces, the attacker can alter the layout of that output, read arbitrary files from the underlying operating system, and use the mechanism to conduct server-side request forgery (SSRF) against other systems reachable from the FMC host.

The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base score 8.5, High) confirms this is remotely reachable over the network, requires low privileges and no user interaction, and has a scope change — consistent with the SSRF and file-read impact described. The flaw affects Cisco Secure FMC Software regardless of device configuration. Cisco has confirmed that Secure Firewall ASA Software and Secure FTD Software are not affected.

This advisory is one of the entries in Cisco’s August 2025 semiannual bundled publication covering Secure Firewall ASA, FMC and FTD software.

What to do

  • Treat this as a management-plane issue tied to FMC’s document generation feature — check which accounts hold Security Analyst (Read Only) or higher roles on your FMC deployment, since that’s the minimum privilege needed to exploit it.
  • Apply Cisco’s fixed software for FMC. The advisory does not list specific fixed release numbers in the material reviewed here; use Cisco’s Software Checker tool (select Cisco FMC Software and your platform, enter your current release) to confirm whether your version is affected and get the exact fixed release.
  • There are no workarounds — patching is the only mitigation Cisco offers for this issue.
  • Because the impact includes arbitrary file read on the underlying OS and SSRF, review outbound network reachability from FMC hosts and any sensitive files exposed to the OS user running FMC services, pending patching.
  • This advisory is bundled with the wider August 2025 Cisco Secure Firewall ASA/FMC/FTD publication — worth checking the linked event response page for other advisories affecting the same FMC deployment.

For leadership 🧭

Executive summary. Anyone holding even a read-only Security Analyst account on Cisco Secure Firewall Management Center can abuse document generation to pull files off the FMC host’s operating system or pivot via SSRF to other internal systems. Because this touches the management plane for firewall infrastructure and needs only low-privilege credentials, it should be scheduled into the next patch cycle without delay.

Why it matters:

  • The flaw sits in FMC’s device-generated document feature, so any workflow that produces reports or exports from FMC is a potential injection point.
  • Exploitation requires only a Security Analyst (Read Only) account, a role many organisations hand out widely for monitoring and reporting purposes.
  • Successful exploitation allows arbitrary file reads from the FMC host’s underlying OS and SSRF against systems reachable from that host, extending impact beyond the FMC interface itself.
  • There are no workarounds, so exposure persists on unpatched FMC instances regardless of configuration until the fix is applied.

Now / Next / Later:

  • Now: Audit which accounts on your FMC deployment hold Security Analyst (Read Only) or higher, since that is the minimum access needed to exploit this.
  • Next: Apply Cisco’s fixed FMC software release identified via the Software Checker tool for your current version and platform during the next change window.
  • Later: Review outbound network reachability from FMC hosts and tighten file permissions for the OS user running FMC services, so a future document-generation flaw cannot be leveraged for SSRF or file disclosure as easily.

Source