CVE-2025-20302: Cisco Firepower Management Center · Missing Authorization
Affects Cisco Firepower Management CenterSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 23% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Firepower Management Center | Affected
| Fixed in– |
AI-suggested
1. Apply Cisco's official patches or updates for Firepower Management Center as soon as they become available to address this authorization flaw. 2. Implement strict access controls and segmentation within FMC to limit user privileges to only necessary domains, minimizing the risk of cross-domain data access. 3. Monitor and audit user access logs within FMC for unusual access patterns or attempts to retrieve reports from unauthorized domains. 4. Enforce strong authentication mechanisms, including multi-factor authentication (MFA), to reduce the risk of credential compromise for low-privileged users. 5. Consider deploying network-level controls such as web application firewalls (WAFs) to detect and block unauthorized attempts to access report files. 6. Educate administrators and users about the risks of credential sharing and phishing attacks that could lead to unauthorized authenticated access. 7. Regularly review FMC configuration and user roles to ensure least privilege principles are maintained. 8. If immediate patching is not possible, restrict access to the FMC management interface to trusted networks and users only.
Description
A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to retrieve a generated report from a different domain. This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by directly accessing a generated report file for a different domain that is managed on the same Cisco Secure FMC instance. A successful exploit could allow the attacker to access a previously run report for a different domain, which could allow an attacker to read activity recorded in that domain.