InfoSecBulletin Cybersecurity for mankind
Cisco has revealed a serious remote code execution vulnerability in its Secure Firewall Management Center (FMC) Software. This flaw, identified as CVE-2025-20265 and rated 10.0 on the CVSS scale, allows unauthenticated attackers to execute commands with high privileges. It poses a significant threat to organizations using affected FMC versions with RADIUS authentication enabled.
According to Cisco, “A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device.”
EDR-Freeze: A Tool That Puts EDRs And Antivirus Into A Coma State
First-ever AI-powered ‘MalTerminal’ Malware Uses OpenAI GPT-4 to Generate Code
Gmail Data exposes via ChatGPT Deep Research Agent dubbed “ShadowLeak Zero-Click” Flaw
Cyber attack disrupts several European airports: check-in and boarding systems affected
Hacker claim to breach Link3; 189,000 Users data up for sale
Check Point Hosts “Securing the Hyperconnected World in the AI Era” in Dhaka
Microsoft Confirms 900+ XSS Vulns Found in IT Services
Daily Security Update Dated : 15.09.2025
IBM QRadar SIEM Vuln Let Attackers Perform Unauthorized Actions
Major Australian Banks using Army of AI Bots to Scam Scammers
The problem arises from inadequate input validation during authentication. An attacker can exploit this by sending malicious input while entering credentials, allowing command execution with high privileges if successful.
Only specific releases are impacted:
Cisco Secure FMC Software versions 7.0.7 and 7.7.0
Only if RADIUS authentication is enabled for the web-based management interface, SSH management, or both.
Cisco confirmed that this vulnerability does not affect:
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Cisco Secure Firewall Threat Defense (FTD) Software
Cisco warns: “There are no workarounds that address this vulnerability.” However, exploitation is only possible if RADIUS authentication is enabled. To mitigate risk before patching, Cisco recommends switching to:
Local user accounts
External LDAP authentication
SAML single sign-on (SSO)
Cisco has released software updates to fix the flaw. The Cisco Product Security Incident Response Team (PSIRT) states that it is unaware of any public announcements or malicious use of the reported vulnerability.
