Cisco FMC – RCE with No Auth Required

Latest Posts
Threats
Vulnerabilities

Cisco FMC – RCE with No Auth Required

by Mike Puglia

2 min read

Cisco has published a critical vulnerability (CVE-2025-20265) with the highest severity score (CVSS 10.0) for its Secure Firewall Management Center (FMC) product. The vulnerability, a Radius Remote Code Execution Vulnerability, enables an unauthenticated attacker to remotely inject arbitrary code, typically shell commands, that are executed at with high level privileges. The flaw is present in FMC versions 7.0.7 and 7.7.0 and requires RADIUS authentication for the web-based management interface, SSH management, or both. Cisco’s internal team discovered the issue during testing and it has not seen exploitation in the wild.

Vulnerability Information

Recommended Actions

Cisco has released free software updates that address this vulnerability and organizations should prioritize upgrading to the latest Cisco FMC version. If immediate updating is not possible, mitigate the vulnerability by switching from RADIUS/SSH to another type of authentication, such as local user accounts, external LDAP authentication, or SAML single sign-on (SSO). As a reminder, Cisco FMC should never have the web-based management interface exposed to the public internet.

Our Response

Datto EDR and RocketCyber Managed SOC both have deployed rules to detect shell processes spawned by FMC-related authentication or web processes such as radius clients, fmc-auth, nginx, httpd and others.

Mike Puglia

General Manager, Security Products

Mike Puglia brings over 25 years of technology, strategy, and cybersecurity experience to his role as Kaseya’s General Manager of Security Products. He is responsible for all products across Kaseya’s portfolio of security solutions.

Prior to joining Kaseya, Mike led the technical program management integration of real-time collaboration technologies into Salesforce’s Chatter Social Enterprise platform. Earlier in his career, Mike served in technical and product roles at applications security company Veracode, database security company Lumigent Technologies and network security Bluesocket.

Mike holds a Bachelor of Science in Electrical Engineering from the University of New Hampshire and an MBA from the Carroll Graduate School of Management at Boston College.