August 15, 2025 By Bill Toulas
Cisco is warning about a critical remote code execution (RCE) vulnerability in the RADIUS subsystem of its Secure Firewall Management Center (FMC) software.
Cisco FCM is a management platform for the vendor’s Secure Firewall products, which provides a centralized web or SSH-based interface to allow administrators to configure, monitor, and update Cisco firewalls.
RADIUS in FMC is an optional external authentication method that permits connecting to a Remote Authentication Dial-In User Service server instead of local accounts.
This configuration is commonly used in enterprise and government networks where administrators want centralized login control and accounting for network device access.
The recently disclosed vulnerability is tracked as CVE-2025-20265 and received the maximum severity score of 10 out of 10.
It can be exploited to allow an unauthenticated remote attacker to send specially crafted input when entering credentials during the RADIUS authentication step.
