# CVE-2025-20265: Cisco Firepower Management Center - RCE

> Live exploitation tracking for CVE-2025-20265 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-20265

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Cisco Firepower Management Center
- **Weaknesses:** CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'))
- **Tags:** firewall, management_panel

## Description

A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device. 

This vulnerability is due to a lack of proper handling of user input during the authentication phase. An attacker could exploit this vulnerability by sending crafted input when entering credentials that will be authenticated at the configured RADIUS server. A successful exploit could allow the attacker to execute commands at a high privilege level.
Note: For this vulnerability to be exploited, Cisco Secure FMC Software must be configured for RADIUS authentication for the web-based management interface, SSH management, or both.

## CrowdSec analysis

[CVE-2025-20265](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-20265) is a critical remote code execution vulnerability in Cisco Firepower Management Center's RADIUS subsystem, allowing unauthenticated attackers to inject and execute arbitrary shell commands with high privileges. Exploitation is possible when RADIUS authentication is enabled for the web or SSH management interfaces, potentially leading to full system compromise. This flaw poses a severe risk, as attackers can gain remote control over affected devices without prior authentication.

CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-20265 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the Cisco FMC CVE-2025-20265 vulnerability by targeting the `/api/fmc_platform/v1/auth/generatetoken` and `/api/fmc_platform/v1/info/serverversion` API endpoints, attempting to authenticate and enumerate server version information to identify and exploit affected versions.

## Timeline

- 2025-08-14: CVE Published. CVE-2025-20265 is published to NVD.
- 2026-04-08: Rule Released. CrowdSec releases a rule to detect CVE-2025-20265 exploitation attempts against the CrowdSec Network.
- 2026-04-13: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-20265 for the first time.

## References

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-radius-rce-TNBKf79
- https://github.com/rix4uni/cvemapping/blob/main/2025/CVE-2025-20265/fmc_cve2025_20265_checker.py

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-20265) follows observed exploitation activity for CVE-2025-20265. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.