InfoSecBulletin Cybersecurity for mankind
Cisco has revealed a serious remote code execution vulnerability in its Secure Firewall Management Center (FMC) Software. This flaw, identified as CVE-2025-20265 and rated 10.0 on the CVSS scale, allows unauthenticated attackers to execute commands with high privileges. It poses a significant threat to organizations using affected FMC versions with RADIUS authentication enabled.
According to Cisco, “A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device.”
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The problem arises from inadequate input validation during authentication. An attacker can exploit this by sending malicious input while entering credentials, allowing command execution with high privileges if successful.
Only specific releases are impacted:
Cisco Secure FMC Software versions 7.0.7 and 7.7.0
Only if RADIUS authentication is enabled for the web-based management interface, SSH management, or both.
Cisco confirmed that this vulnerability does not affect:
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Cisco Secure Firewall Threat Defense (FTD) Software
Cisco warns: “There are no workarounds that address this vulnerability.” However, exploitation is only possible if RADIUS authentication is enabled. To mitigate risk before patching, Cisco recommends switching to:
Local user accounts
External LDAP authentication
SAML single sign-on (SSO)
Cisco has released software updates to fix the flaw. The Cisco Product Security Incident Response Team (PSIRT) states that it is unaware of any public announcements or malicious use of the reported vulnerability.
