CVE-2025-20220
published 2025-08-14CVE-2025-20220: A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an…
PriorityP336medium6CVSS 3.1
AVLACLPRHUINSUCHIHAN
EPSS
0.17%
7.0th percentile
A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root.
This vulnerability is due to improper input validation for specific CLI commands. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials.
For more information about vulnerable scenarios, see the Details ["#details"] section of this advisory.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_management_center | — | — |
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | secure_firewall_management_center_and_secure_firewall_threat_defense | — | — |
CVSS provenance
nvdv3.16.0MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
vendor_cisco6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Command Injection Vulnerability
vendor_cisco·2025-08-14·CVSS 6.0
CVE-2025-20220 [MEDIUM] CWE-78 Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Command Injection Vulnerability
Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root.
This vulnerability is due to improper input validation for specific CLI commands. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Adm
Cisco
Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Command Injection Vulnerability
vendor_cisco·CVSS 3.1
CVE-2025-20220 Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Command Injection Vulnerability
CVE-2025-20220: Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root . This vulnerability is due to improper input validation for specific CLI commands. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would
GHSA
GHSA-q2qh-qxqj-v3qp: A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could all
ghsa_unreviewed·2025-08-14
CVE-2025-20220 [MEDIUM] CWE-78 GHSA-q2qh-qxqj-v3qp: A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could all
A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root.
This vulnerability is due to improper input validation for specific CLI commands. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials.
For more information about vulnerable scenarios, see the Details ["#details"] section of thi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-14
Published