Cisco Secure Firewall Management Centers Connected to RADIUS Left Vulnerable
Networking equipment giant Cisco warned firewall customers to patch after discovering a maximum-severity vulnerability that could allow unauthenticated hackers to commandeer the server.
See Also: What Manufacturing Leaders Are Learning About Cloud Security – from Google’s Frontline
The flaw, tracked as CVE-2025-20265, affects instances of Cisco Secure Firewall Management Center that use a RADIUS server for user authentication. The vulnerability is triggered by the improper handling of user input during authentication, Cisco said Thursday.
The flaw rates a maximum score of 10 on the CVSS system. A “successful exploit could allow the attacker to execute commands at a high privilege level,” the company warned.
Cisco touts its Firewall Management Center as a centralized mechanism for managing Cisco firewalls deployed across a large enterprise. The vulnerability affects versions 7.0.7 and 7.7.0.
RADIUS – short for Remote Authentication Dial-In User Service – is a network protocol for authentication, authorization and accounting that dates to the early 1990s but has persisted as a standard for networking appliances. Researchers in July 2024 found it susceptible to man-in-the-middle attacks (see: Widely Used RADIUS Authentication Flaw Enables MITM Attacks).
Cisco said there are no workarounds to the vulnerability, but switching away from RADIUS to another authentication mechanism such as SAML single sign-on or local user accounts would mitigate the flaw.
Cisco’s Product Security Incident Response Team has not observed any active exploitation of the vulnerability in the wild, but attackers often reverse-engineer patches to create exploits within days of disclosure. A VulnCheck report this year found that nearly a third of vulnerabilities were exploited on or before the day they were published.
Cisco included the fix in its semiannual security update bundle, which also addressed other high-severity issues across its firewall product line. Cisco said the patches are available free to customers with valid support contracts.
“A level 10 vulnerability in a widely used network defense product like Cisco FMC is a red alert for CISOs, system admins and IT leaders,” said Keith King, former White House lead communications engineer in a LinkedIn post. “With no workaround and a wide attack surface, the only responsible course of action is immediate patching.”
This isn’t Cisco’s only recent critical patch. Last month, the company issued a maximum-severity fix for unified communications managers after discovering static root credentials in development-only builds (see: Static Credentials Flaw Patched in Cisco Systems).