---
title: "Security Bulletin: Cisco Secure Firewall Management Center (FMC) RADIUS Remote Code Execution Vulnerability"
description: Cisco Secure Firewall Management Center (FMC) vulnerability (CVE-2025-20265) allows unauthenticated RCE via crafted RADIUS credentials. CVSS 10.0. Patch affected versions (7.0.7, 7.7.0) or disable RADIUS immediately.
---

[Cybersecurity Blog | RedLegg ](https://www.redlegg.com/blog)

# [Security Bulletin: Cisco Secure Firewall Management Center (FMC) RADIUS Remote Code Execution Vulnerability](https://www.redlegg.com/blog/security-bulletin-cisco-secure-firewall-management-center-fmc-radius-remote-code-execution-vulnerability)

 Written by [RedLegg's Cyber Threat Intelligence Team](https://www.redlegg.com/blog/author/redleggs-cyber-threat-intelligence-team) | 8/15/25 5:44 PM

About:

RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.

## VULNERABILITIES

### Cisco Secure Firewall Management Center (FMC) RADIUS Remote Code Execution Vulnerability

 

**CVSS Score**: 10.0 (Critical)**  
****Identifier**: CVE-2025-20265**  
****Exploit or POC**:  No  
**Update**:  CVE-2025-20265 – [Cisco Security Advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-radius-rce-TNBKf79)

**Description**: CVE-2025-20265 is a critical command injection vulnerability in Cisco Secure Firewall Management Center (FMC). The flaw arises from improper input validation in the RADIUS authentication subsystem. An unauthenticated remote attacker can exploit it by submitting crafted credentials during authentication, potentially injecting and executing arbitrary shell commands with elevated privileges. This exposure can occur only if FMC is configured to use RADIUS for web-based or SSH management authentication.

Affected Versions:

Cisco FMC software versions 7.0.7 and 7.7.0 are vulnerable when RADIUS is enabled.

 

**Mitigation Recommendation**: 

- Apply Cisco’s security update for the affected FMC versions immediately.
- If patching cannot be performed right away, disable RADIUS authentication and switch to alternative methods such as local accounts, LDAP, or SAML SSO.
- Limit access to FMC management interfaces using network segmentation, firewall rules, and access control lists.
- Monitor authentication logs for anomalous or suspicious credential attempts that may indicate exploitation.

 

[View full post](https://www.redlegg.com/blog/security-bulletin-cisco-secure-firewall-management-center-fmc-radius-remote-code-execution-vulnerability)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "RedLegg's Cyber Threat Intelligence Team"
  },
  "dateModified" : "2025-08-15T17:44:28.204Z",
  "datePublished" : "2025-08-15T17:44:28Z",
  "headline" : "Emergency Security Bulletin: Cisco Secure Firewall Management Center (FMC) RADIUS Remote Code Execution Vulnerability",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://www.redlegg.com/hubfs/Emergency%20Bulletin%20v2.png",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://www.redlegg.com/blog/security-bulletin-cisco-secure-firewall-management-center-fmc-radius-remote-code-execution-vulnerability",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/4675768/logo-red-01.png",
      "width" : 419.66666
    },
    "name" : "RedLegg Cybersecurity Blog"
  }
}
```