VulnerabilityPublished 14 Aug 2025

CVE-2025-20302: Cisco Firepower Management Center · Missing Authorization

Affects Cisco Firepower Management CenterSource CVE Database V5

Not known to be exploited · CVSS 4.3 Medium.

Data as of 26 Oct 2026, 10:12 UTC

CVSS 3.1 base score

4.3Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 23% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Cisco Cisco Firepower Management Center	Affected 6.2.3 – 7.6.0 92 affected builds	Fixed in–

AI-suggested

Apply Cisco's official patches or updates for Firepower Management Center as soon as they become available to address this authorization flaw.
Implement strict access controls and segmentation within FMC to limit user privileges to only necessary domains, minimizing the risk of cross-domain data access.
Monitor and audit user access logs within FMC for unusual access patterns or attempts to retrieve reports from unauthorized domains.
Enforce strong authentication mechanisms, including multi-factor authentication (MFA), to reduce the risk of credential compromise for low-privileged users.
Consider deploying network-level controls such as web application firewalls (WAFs) to detect and block unauthorized attempts to access report files.
Educate administrators and users about the risks of credential sharing and phishing attacks that could lead to unauthorized authenticated access.
Regularly review FMC configuration and user roles to ensure least privilege principles are maintained.
If immediate patching is not possible, restrict access to the FMC management interface to trusted networks and users only.

Description

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to retrieve a generated report from a different domain. This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by directly accessing a generated report file for a different domain that is managed on the same Cisco Secure FMC instance. A successful exploit could allow the attacker to access a previously run report for a different domain, which could allow an attacker to read activity recorded in that domain.

Impact

For European organizations, the impact of CVE-2025-20302 primarily concerns confidentiality breaches within multi-domain or multi-tenant Cisco FMC deployments. Organizations using FMC to manage segmented networks or multiple business units could have sensitive operational reports exposed to unauthorized users within the same FMC instance. This exposure could lead to leakage of security monitoring data, network activity logs, or incident reports, undermining trust in internal security controls. While the vulnerability does not allow modification or disruption of services, the unauthorized disclosure of sensitive information could facilitate lateral movement, targeted attacks, or compliance violations under regulations such as GDPR. Organizations in critical infrastructure sectors, finance, telecommunications, and government are particularly at risk due to the sensitive nature of their network monitoring data. The vulnerability's requirement for authenticated access limits exposure to insiders or attackers who have compromised low-privileged credentials, but this remains a significant risk vector given the prevalence of credential theft. The broad range of affected FMC versions means many European enterprises may be vulnerable if they have not applied patches or mitigations.

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-authz-bypass-M7xhnAu (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2025, 17:09 UTC

Technical details

References

Community reviews

Related threats