CVE-2025-20306: Cisco Firepower Management Center · Command Injection
Affects Cisco Firepower Management CenterSource CVE Database V5
Not known to be exploited · CVSS 4.9 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 32% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Firepower Management Center | Affected
| Fixed in– |
AI-suggested
1. Apply patches and updates from Cisco as soon as they become available for affected FMC versions to remediate the vulnerability. 2. Restrict administrative access to the FMC management interface using network segmentation, VPNs, and IP whitelisting to limit exposure to trusted personnel only. 3. Enforce strong multi-factor authentication (MFA) for all administrator accounts to reduce the risk of credential compromise. 4. Regularly audit and monitor administrative account usage and login activity for signs of unauthorized access or suspicious behavior. 5. Implement strict input validation and web application firewall (WAF) rules where possible to detect and block malicious HTTP requests targeting the management interface. 6. Conduct periodic security assessments and penetration testing focused on management interfaces to identify and remediate similar vulnerabilities proactively. 7. Educate administrators on phishing and credential theft risks to prevent account compromise. 8. Maintain up-to-date backups and incident response plans to quickly recover from potential compromises.
Description
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker with Administrator-level privileges to execute arbitrary commands on the underlying operating system. This vulnerability is due to insufficient input validation of certain HTTP request parameters that are sent to the web-based management interface. An attacker could exploit this vulnerability by authenticating to the interface and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to execute commands as the root user on the affected device. To exploit this vulnerability, an attacker would need Administrator-level credentials.