CVE-2025-20265 PoC — Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability

Source

https://github.com/saruman9/cve_2025_20265

Associated Vulnerability

Title: Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability (CVE-2025-20265)
Description:A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device.  This vulnerability is due to a lack of proper handling of user input during the authentication phase. An attacker could exploit this vulnerability by sending crafted input when entering credentials that will be authenticated at the configured RADIUS server. A successful exploit could allow the attacker to execute commands at a high privilege level. Note: For this vulnerability to be exploited, Cisco Secure FMC Software must be configured for RADIUS authentication for the web-based management interface, SSH management, or both.

Description

PoC for CVE-2025-20265 Cisco Secure FMC Software RADIUS Remote Code Execution Vulnerability

Readme

# PoC for CVE-2025-20265

- [Advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-radius-rce-TNBKf79)

## ⚠️ WARNING

This is a functional exploit for a 1-day vulnerability.

- **It can execute code on vulnerable systems.**
- **Use only on your own internal servers you are authorized to test.**
- **Unauthorized use is illegal and unethical.**

**Use at your own risk. You are responsible for your actions.**

## Building

1. [Install Rust](https://www.rust-lang.org/tools/install)
2. Build the PoC:

```sh
cargo build --release
```

## Usage

```sh
$ ./target/release/cve_2025_20265 --help
# or
$ cargo run --release -- --help
```

To debug, use the environment variable `RUST_LOG`:

```sh
RUST_LOG=debug cargo run --release -- --help
```

## Examples

```sh
# use either the build or the path to the executable file
$ alias EXE="cargo run --release"
# or
$ cargo build --release
$ alias EXE="./target/release/cve_2025_20265"

# check the target
$ EXE https://10.10.10.1:4443/

# read targets from the file
$ echo -e "https://10.10.10.1:4443\nhttp://127.0.0.1\nhttp://10.10.10.10" > targets.txt
$ EXE --from-file targets.txt
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →