InfoSecBulletin Cybersecurity for mankind
Cisco has revealed a serious remote code execution vulnerability in its Secure Firewall Management Center (FMC) Software. This flaw, identified as CVE-2025-20265 and rated 10.0 on the CVSS scale, allows unauthenticated attackers to execute commands with high privileges. It poses a significant threat to organizations using affected FMC versions with RADIUS authentication enabled.
According to Cisco, “A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device.”
Daily Cyber security update for 14.11. 2026
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
The problem arises from inadequate input validation during authentication. An attacker can exploit this by sending malicious input while entering credentials, allowing command execution with high privileges if successful.
Only specific releases are impacted:
Cisco Secure FMC Software versions 7.0.7 and 7.7.0
Only if RADIUS authentication is enabled for the web-based management interface, SSH management, or both.
Cisco confirmed that this vulnerability does not affect:
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Cisco Secure Firewall Threat Defense (FTD) Software
Cisco warns: “There are no workarounds that address this vulnerability.” However, exploitation is only possible if RADIUS authentication is enabled. To mitigate risk before patching, Cisco recommends switching to:
Local user accounts
External LDAP authentication
SAML single sign-on (SSO)
Cisco has released software updates to fix the flaw. The Cisco Product Security Incident Response Team (PSIRT) states that it is unaware of any public announcements or malicious use of the reported vulnerability.
