CVE-2025-20148
BaseFortify
Publication date: 2025-08-14
Last updated on: 2025-08-25
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | secure_firewall_management_center | 7.0.6 |
| cisco | secure_firewall_management_center | 7.0.6.1 |
| cisco | secure_firewall_management_center | 7.0.6.2 |
| cisco | secure_firewall_management_center | 7.0.6.3 |
| cisco | secure_firewall_management_center | 7.2.4 |
| cisco | secure_firewall_management_center | 7.2.4.1 |
| cisco | secure_firewall_management_center | 7.2.5 |
| cisco | secure_firewall_management_center | 7.2.5.1 |
| cisco | secure_firewall_management_center | 7.2.5.2 |
| cisco | secure_firewall_management_center | 7.2.6 |
| cisco | secure_firewall_management_center | 7.2.7 |
| cisco | secure_firewall_management_center | 7.2.8 |
| cisco | secure_firewall_management_center | 7.2.8.1 |
| cisco | secure_firewall_management_center | 7.2.9 |
| cisco | secure_firewall_management_center | 7.4.0 |
| cisco | secure_firewall_management_center | 7.4.1 |
| cisco | secure_firewall_management_center | 7.4.1.1 |
| cisco | secure_firewall_management_center | 7.4.2 |
| cisco | secure_firewall_management_center | 7.4.2.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software. It allows an authenticated remote attacker, who has at least Security Analyst (Read Only) role credentials, to inject arbitrary HTML content into device-generated documents. This happens because the software improperly validates user-supplied data. Exploiting this flaw, an attacker can alter the layout of documents, read arbitrary files from the underlying operating system, and perform server-side request forgery (SSRF) attacks.
How can this vulnerability impact me? :
The impact of this vulnerability includes unauthorized alteration of device-generated documents, exposure of sensitive information through reading arbitrary files on the system, and potential SSRF attacks that could be used to access internal resources. This could lead to information disclosure and manipulation of firewall management data, potentially compromising network security.