InfoSecBulletin Cybersecurity for mankind
Cisco has revealed a serious remote code execution vulnerability in its Secure Firewall Management Center (FMC) Software. This flaw, identified as CVE-2025-20265 and rated 10.0 on the CVSS scale, allows unauthenticated attackers to execute commands with high privileges. It poses a significant threat to organizations using affected FMC versions with RADIUS authentication enabled.
According to Cisco, “A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device.”
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
The problem arises from inadequate input validation during authentication. An attacker can exploit this by sending malicious input while entering credentials, allowing command execution with high privileges if successful.
Only specific releases are impacted:
Cisco Secure FMC Software versions 7.0.7 and 7.7.0
Only if RADIUS authentication is enabled for the web-based management interface, SSH management, or both.
Cisco confirmed that this vulnerability does not affect:
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Cisco Secure Firewall Threat Defense (FTD) Software
Cisco warns: “There are no workarounds that address this vulnerability.” However, exploitation is only possible if RADIUS authentication is enabled. To mitigate risk before patching, Cisco recommends switching to:
Local user accounts
External LDAP authentication
SAML single sign-on (SSO)
Cisco has released software updates to fix the flaw. The Cisco Product Security Incident Response Team (PSIRT) states that it is unaware of any public announcements or malicious use of the reported vulnerability.
