Cisco Secure Firewall Management Center Software RADIUS Remote Code Execution Vulnerability

🚨SEVERITY: CRITICAL — CVSS 10.0Security Advisory

TL;DR 📌

  • A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device. This vulnerability is due to a lack of proper handling of user input during the authentication phase. An attacker could exploit this vulnerability…
  • Highest CVSS: 10.0 (Critical).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20265.

What it is

CVE-2025-20265 is a shell command injection flaw in the RADIUS authentication subsystem of Cisco Secure Firewall Management Center (FMC) Software. It affects releases 7.0.7 and 7.7.0, but only when RADIUS authentication is configured for the web-based management interface, SSH management, or both.

The problem is in how user input is handled during the authentication phase. An unauthenticated remote attacker can send crafted input in the credential fields at login — this input is passed through to the configured RADIUS server without proper sanitisation, allowing arbitrary shell commands to be injected and executed on the FMC appliance at a high privilege level.

This sits on the management plane: it requires no prior authentication, only network reachability to the FMC’s management interface (web UI or SSH) with RADIUS configured as the authentication backend. Cisco has confirmed ASA and FTD software are not affected — this is specific to FMC.

Cisco states it is not aware of any public announcements or malicious use of this vulnerability at the time of publication.

What to do

  • Check whether RADIUS authentication is configured on your FMC deployment (web UI or SSH management) — see the RADIUS external authentication object settings in the FMC Administration Guide. If RADIUS is not in use, you are not exposed.
  • Upgrade affected FMC releases (7.0.7, 7.7.0) to the fixed version referenced in Cisco’s advisory (cisco-sa-fmc-radius-rce-TNBKf79) via the Cisco Software Checker or your usual update channel.
  • There is no workaround that patches the flaw itself. If you cannot upgrade immediately, switch FMC authentication away from RADIUS to local user accounts, external LDAP, or SAML SSO — Cisco confirms this removes the exploit path, though you should validate the change against your own environment before deploying it.
  • Restrict network access to FMC’s management interfaces (web UI, SSH) to trusted management networks regardless of authentication method, as a general reduction of exposure while you plan the upgrade.

For leadership 🧭

Executive summary. Any FMC appliance running 7.0.7 or 7.7.0 with RADIUS logins enabled for the web UI or SSH can be taken over remotely without credentials, at maximum CVSS severity. Given FMC manages your firewall estate, this needs same-day triage of RADIUS usage and an urgent patch or authentication switch, not routine change-window scheduling.

Why it matters:

  • FMC is the central management point for Secure Firewall deployments — command execution there at high privilege gives an attacker control over the console that configures your firewalls
  • No authentication is required; the attacker only needs network reachability to the FMC web UI or SSH interface where RADIUS is configured as the backend
  • The flaw sits in the credential fields themselves, so normal login monitoring may not distinguish a malicious attempt from a failed login until commands have already run
  • There is no patch-independent workaround — the only interim fix is to stop using RADIUS for FMC authentication entirely, which is an operational change, not a config tweak

Now / Next / Later:

  • Now: Check every FMC instance for RADIUS authentication on the web UI or SSH management interface; if RADIUS is not configured, this vulnerability does not apply to you.
  • Next: Upgrade any FMC running 7.0.7 or 7.7.0 with RADIUS enabled to the fixed release identified in Cisco’s advisory via your usual update channel or the Cisco Software Checker.
  • Later: Where upgrading isn’t immediately possible, move FMC authentication to local accounts, LDAP, or SAML SSO, and restrict management-interface access to trusted networks as standing practice.

Source