CVE-2025-20265

The vulnerability results from lack of proper validation of user input data during the RADIUS authentication phase (CWE-74 — injection). The attacker sends specially crafted data in credential fields, which are then forwarded to the configured RADIUS server. Injected commands are executed by the device with high privilege level, without the need for prior authentication. A necessary condition for exploiting the vulnerability is configuring Cisco Secure FMC for RADIUS authentication for the web management interface, SSH management, or both channels simultaneously.

Successful exploitation of the vulnerability allows an attacker to execute arbitrary shell commands with high privilege level, which in practice means complete takeover of the firewall management device — potentially compromising the confidentiality, integrity, and availability of the entire managed network infrastructure.

Apply patches available from the vendor according to references — detailed information about patched versions is contained in the Cisco Security Advisory guide (cisco-sa-fmc-radius-rce-TNBKf79). Until the patch is implemented, it is recommended to disable RADIUS authentication for management interfaces or restrict access to these interfaces only to trusted IP addresses using access control rules.

Cisco Secure Firewall Management Center (FMC) Software configured for RADIUS authentication for web management interface and/or SSH management. Specific versions indicated in vendor references.