Cisco Firepower Management Center CLI os command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in Cisco Firepower Management Center and Firepower Threat Defense. The impacted element is an unknown function of the component CLI. The manipulation leads to os command injection. This vulnerability is referenced as CVE-2025-20220. The attack can only be performed from a local environment. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Cisco Firepower Management Center and Firepower Threat Defense (affected version unknown). This issue affects an unknown functionality of the component CLI. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. This vulnerability is due to improper input validation for specific CLI commands. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials. For more information about vulnerable scenarios, see the Details ["#details"] section of this advisory.

It is possible to read the advisory at sec.cloudapps.cisco.com. The identification of this vulnerability is CVE-2025-20220 since 10/10/2024. The exploitation is known to be easy. Attacking locally is a requirement. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/17/2025). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-24880) and CERT Bund (WID-SEC-2025-1840). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Cisco Secure Firewall Management Center

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Firepower Management Center
• Firepower Threat Defense

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion