CVE-2025-20148
published 2025-08-14CVE-2025-20148: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker…
PriorityP260high8.5CVSS 3.1
AVNACLPRLUINSCCHILAN
EPSS
0.43%
35.0th percentile
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document.
This vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by submitting malicious content to an affected device and using the device to generate a document that contains sensitive information. A successful exploit could allow the attacker to alter the standard layout of the device-generated documents, read arbitrary files from the underlying operating system, and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (Read Only).
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attacker must be authenticated with at least the 'Security Analyst (Read Only)' role to exploit this vulnerability — monitor for low-privileged accounts generating or exporting device documents unexpectedly. ↗
- →Exploitation involves submitting malicious HTML content via the web-based management interface and triggering document generation — monitor FMC web UI activity for unusual report/document generation requests from low-privileged users. ↗
- →Successful exploitation may result in SSRF attacks originating from the FMC — monitor for unexpected outbound HTTP/S connections from the FMC host to internal or external resources. ↗
- →Track Cisco Bug ID CSCwk85702 for patch and indicator updates related to this vulnerability. ↗
- ·There are no workarounds available for this vulnerability — patching via Cisco software updates is the only remediation. ↗
- ·This vulnerability is part of the August 2025 Cisco Secure Firewall bundled advisory release — multiple related CVEs may affect the same platform and should be reviewed together. ↗
CVSS provenance
nvdv3.18.5HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
vendor_cisco8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wx6g-rg4g-cr55: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote a
ghsa_unreviewed·2025-08-14
CVE-2025-20148 [HIGH] CWE-20 GHSA-wx6g-rg4g-cr55: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote a
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document.
This vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by submitting malicious content to an affected device and using the device to generate a document that contains sensitive information. A successful exploit could allow the attacker to alter the standard layout of the device-generated documents, read arbitrary files from the underlying operating system, and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with a
Cisco
Cisco Secure Firewall Management Center Software HTML Injection Vulnerability
vendor_cisco·2025-08-14·CVSS 8.5
CVE-2025-20148 [HIGH] CWE-20 Cisco Secure Firewall Management Center Software HTML Injection Vulnerability
Cisco Secure Firewall Management Center Software HTML Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document.
This vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by submitting malicious content to an affected device and using the device to generate a document that contains sensitive information. A successful exploit could allow the attacker to alter the standard layout of the device-generated documents, read arbitrary files from the underlying operating system, and conduct server-side request forgery (SSRF) attacks. To exploit this vu
Cisco
Cisco Secure Firewall Management Center Software HTML Injection Vulnerability
vendor_cisco·CVSS 3.1
CVE-2025-20148 Cisco Secure Firewall Management Center Software HTML Injection Vulnerability
CVE-2025-20148: Cisco Secure Firewall Management Center Software HTML Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document. This vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by submitting malicious content to an affected device and using the device to generate a document that contains sensitive information. A successful exploit could allow the attacker to alter the standard layout of the device-generated documents, read arbitrary files from the underlying operating system, and conduct server-side request forgery (SSRF) attacks. To e
No detection rules found.
No public exploits indexed.
2025-08-14
Published