Cisco Firewall Brain Hit by CVSS 10.0 RCE Flaw, Admins Must Act Fast!

A maximum-severity remote code execution bug in Cisco Secure Firewall Management Center (FMC) lets unauthenticated attackers run shell commands with elevated privileges if RADIUS authentication is enabled for FMC’s web UI or SSH. Patches are available; if you can’t patch immediately, disable RADIUS on FMC and use an alternative authentication method. Cisco says it hasn’t seen exploitation yet.

Cisco disclosed CVE-2025-20265 (CVSS 10.0) in FMC’s RADIUS subsystem. An attacker can send crafted credentials during authentication and get arbitrary command execution on the management appliance with high privilege. No prior auth is needed, but FMC must be configured to use RADIUS for the web console, SSH, or both.

Why this is special: FMC is the central brain for Secure Firewall deployments—policy, logging, upgrades, everything. Compromise here can cascade into rule tampering, defense blind spots, or lateral movement into the rest of the network.

What Cisco and others say (and what that means)

Affected: FMC 7.0.7 and 7.7.0 when RADIUS is enabled for web/SSH management.
Root cause: Insufficient input handling in the RADIUS authentication flow, enabling command injection.
Discovery & exploitation status: Found internally (credited to Brandon Sakai); no known in-the-wild exploitation as of publication.
Fixes: Free software updates are available via normal channels.
Mitigation if you cannot patch now: Disable RADIUS authentication on FMC and switch to local accounts, LDAP, or SAML SSO. Cisco notes this worked in testing, but you must validate in your environment.

Cisco also bundled this disclosure into its August 14, 2025 Secure Firewall advisory rollup (29 vulns across ASA/FTD/FMC). That event page confirms the CVSS 10.0 rating for CVE-2025-20265 and the multi-product patch drop.

Why defenders should care (beyond “it’s a 10.0”)

Pre-auth RCE on the management plane: Attackers don’t need accounts—just a reachable management interface that uses RADIUS. Exposed management planes or jump-box pivoting become particularly risky.
Policy authority: With FMC access, an adversary could push permissive rules, drain logs, or disable inspections—quietly degrading controls before moving elsewhere. (This is the classic “turn off the cameras” move.)
Rapid commoditization risk: Bugs with deterministic input paths often attract scanning and PoC release. Third-party write-ups already flag the attractiveness of this vuln to threat actors. Patch windows should be measured in hours/days, not weeks.

A prioritized playbook

Now (0–24 hours)

Identify exposure: Inventory all FMC instances; note version and whether RADIUS auth is enabled for web/SSH. (If you don’t use RADIUS, your risk for this CVE is dramatically lower.)
Patch where possible: Apply Cisco’s fixed releases for affected tracks.
If you cannot patch immediately: Disable RADIUS on FMC and move to local/LDAP/SAML. Test admin logins and break-glass flows before and after the change.
Reduce blast radius:

Ensure FMC management is not internet-reachable.
Restrict access via VPN + MFA, IP allowlists, and jump hosts.
Review admin group memberships and rotate credentials shared with RADIUS backends.

Next (24–72 hours) 5\) Hunt & monitor:

Look for failed/odd FMC login attempts with unusual username strings (payload-like characters), followed by new admin sessions or command execution.
Correlate with RADIUS server logs for credential fields containing special characters. (Exploit attempts may show up as authentication failures.)
Watch for sudden rule/policy changes or disabled inspections.

Backups & integrity: Validate FMC backups/golden configs; compare running vs. approved policies for drift.

Sustain (this week) 7\) Post-patch validation: Confirm FMC build numbers and that RADIUS remains disabled (if used as mitigation) until you can re-enable safely. 8\) Management-plane hygiene: Segment FMC, require MFA, and log every admin action to a remote SIEM.

Alongside CVE-2025-20265, Cisco shipped fixes for multiple high-severity issues affecting ASA/FTD/FMC (largely denial-of-service and management-interface bugs). Highlights include Snort 3 DoS (CVE-2025-20217), IPv6 over IPsec DoS (CVE-2025-20222), Remote Access VPN DoS (CVE-2025-20244), IKEv2 DoS set (CVE-2025-20224/-20225), and more. Cisco notes no workarounds for most of these—except for CVE-2025-20127, where removing a TLS 1.3 cipher is advised. Patch priority should consider your features in use and exposure of web/VPN endpoints.

A non-exhaustive list from Cisco’s and community summaries: CVE-2025-20217, -20222, -20148, -20244, -20133/-20243, -20134, -20136, -20251, -20224/-20225, -20263, -20127 (TLS 1.3), among others in the August bundle. Review Cisco’s matrix to determine which of your exact devices run on it.

Key facts at a glance

CVE: 2025-20265 (CWE-74 command injection)
Product: Cisco Secure FMC (management plane)
Versions impacted: 7.0.7 and 7.7.0, when RADIUS auth is enabled for web/SSH
Impact: Pre-auth RCE → elevated shell commands on FMC
Status: Patches available; no active exploitation reported by Cisco at disclosure
Fallback mitigation: Disable RADIUS on FMC; use local/LDAP/SAML (validate locally)
First published: August 14, 2025 (Cisco bundle); news coverage Aug 15, 2025

Cisco Firewall Brain Hit by CVSS 10.0 RCE Flaw, Admins Must Act Fast!

Related threat feeds

Splunk Enterprise Vulnerability Enables Unauthenticated Remote Code Execution

What Cisco and others say (and what that means)

Why defenders should care (beyond “it’s a 10.0”)

A prioritized playbook

Key facts at a glance

FIFA World Cup Broadcast Infrastructure Exposed Through Broken Authorization Flaw

ServiceNow MID Server Authentication Bypass Exploited to Extract Data from 341 Customer Instances

Cisco Firewall Brain Hit by CVSS 10.0 RCE Flaw, Admins Must Act Fast!

Related threat feeds

Splunk Enterprise Vulnerability Enables Unauthenticated Remote Code Execution

What Cisco and others say (and what that means)

Why defenders should care (beyond “it’s a 10.0”)

A prioritized playbook

Related Cisco fixes you shouldn’t ignore

Key facts at a glance

FIFA World Cup Broadcast Infrastructure Exposed Through Broken Authorization Flaw

ServiceNow MID Server Authentication Bypass Exploited to Extract Data from 341 Customer Instances