Cisco Firepower Management Center - RCE (CVE-2025-20265)
Description
A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device.
This vulnerability is due to a lack of proper handling of user input during the authentication phase. An attacker could exploit this vulnerability by sending crafted input when entering credentials that will be authenticated at the configured RADIUS server. A successful exploit could allow the attacker to execute commands at a high privilege level. Note: For this vulnerability to be exploited, Cisco Secure FMC Software must be configured for RADIUS authentication for the web-based management interface, SSH management, or both.
psychologyCrowdSec Analysis
CVE-2025-20265 is a critical remote code execution vulnerability in Cisco Firepower Management Center's RADIUS subsystem, allowing unauthenticated attackers to inject and execute arbitrary shell commands with high privileges. Exploitation is possible when RADIUS authentication is enabled for the web or SSH management interfaces, potentially leading to full system compromise. This flaw poses a severe risk, as attackers can gain remote control over affected devices without prior authentication.
CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-20265 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the Cisco FMC CVE-2025-20265 vulnerability by targeting the /api/fmc_platform/v1/auth/generatetoken and /api/fmc_platform/v1/info/serverversion API endpoints, attempting to authenticate and enumerate server version information to identify and exploit affected versions.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-08-14 |
| Rule Released | 2026-04-08 |
| CrowdSec First Seen | 2026-04-13 |