Cisco Firepower Management Center up to 7.4.2.1 Web-based Management Interface server-side request forgery

Summaryinfo

A vulnerability described as critical has been identified in Cisco Firepower Management Center. This issue affects some unknown processing of the component Web-based Management Interface. Such manipulation leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2025-20148. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Cisco Firepower Management Center. It has been rated as critical. Affected by this issue is an unknown code block of the component Web-based Management Interface. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document. This vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by submitting malicious content to an affected device and using the device to generate a document that contains sensitive information. A successful exploit could allow the attacker to alter the standard layout of the device-generated documents, read arbitrary files from the underlying operating system, and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (Read Only).

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is handled as CVE-2025-20148 since 10/10/2024. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/17/2025).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-1841). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Cisco Secure Firewall Management Center

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Firepower Management Center

Version

• 7.0.6
• 7.0.6.1
• 7.0.6.2
• 7.0.6.3
• 7.2.4
• 7.2.4.1
• 7.2.5
• 7.2.5.1
• 7.2.5.2
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.8.1
• 7.2.9
• 7.4.0
• 7.4.1
• 7.4.1.1
• 7.4.2
• 7.4.2.1

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion