Cisco Secure Firewall Management Center Software XPATH Injection Vulnerability

🚨SEVERITY: MEDIUM — CVSS 4.9Security Advisory

TL;DR 📌

  • A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an…
  • Highest CVSS: 4.9 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20218.

What it is

CVE-2025-20218 is an XPATH injection flaw in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software. It results from insufficient input validation of requests submitted through that interface.

Exploitation requires an authenticated, remote attacker holding valid administrative credentials. By sending a crafted request to the management interface, the attacker can retrieve sensitive information from the affected device. There is no privilege escalation or code execution described — the impact is confined to information disclosure (confidentiality impact only, per the CVSS vector: C:H/I:N/A:N).

The advisory notes this only affects FMC deployments where lockdown mode is enabled; lockdown mode is disabled by default. Cisco points out that with lockdown mode disabled, root-level shell access is already available via the expert CLI command, which is why the vulnerability is scoped to the lockdown-enabled case. Cisco Secure Firewall ASA, Secure FTD, and Secure IPS are confirmed not affected.

What to do

  • Check whether lockdown mode is enabled on your FMC deployment — this vulnerability only applies in that configuration. If lockdown mode is disabled, this specific issue does not apply, though you should review your hardening posture generally.
  • Use the Cisco Software Checker tool (linked in the advisory) against your current FMC release to identify the First Fixed and Combined First Fixed versions for CVE-2025-20218; the advisory does not list a fixed release directly in the text, but confirms updates have been released.
  • Apply the applicable FMC software update once identified — there are no workarounds for this vulnerability.
  • Tighten access to administrative accounts on FMC, since exploitation requires valid admin credentials; review who holds administrative access to the management interface.
  • Consult the Cisco Secure Firewall Management Center Hardening Guide referenced in the advisory if you rely on lockdown mode as part of your hardening baseline.

For leadership 🧭

Executive summary. This flaw only bites FMC deployments that have deliberately enabled lockdown mode as a hardening measure, and even then it requires valid admin credentials to exploit, so the risk is confined to information disclosure by a trusted insider or compromised admin account. It should be scheduled into a normal patch cycle rather than treated as an emergency.

Why it matters:

  • Affects Cisco Secure Firewall Management Center’s web management interface specifically, not ASA, FTD or Secure IPS, which Cisco has confirmed are unaffected
  • Only applies when lockdown mode is enabled — a setting used to restrict the root-level expert CLI shell access that is otherwise available by default
  • Exploitation needs valid administrative credentials, so this raises the value of protecting and monitoring FMC admin accounts rather than being an unauthenticated remote threat
  • Impact is limited to retrieving sensitive information from the device; there is no indication of privilege escalation or code execution

Now / Next / Later:

  • Now: Check whether lockdown mode is enabled on each FMC deployment, since the vulnerability only applies in that configuration.
  • Next: Run the Cisco Software Checker against your current FMC release to identify the fixed version, and apply it in the next maintenance window — there is no workaround.
  • Later: Review who holds administrative access to the FMC management interface and revisit the Cisco Secure Firewall Management Center Hardening Guide to ensure lockdown mode configuration stays aligned with current guidance.

Source