PT-2025-33337 · Cisco · Cisco Secure Fmc

Published 2024-10-10 · Updated 2025-08-15 · CVE-2025-20301

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Secure FMC Software (affected versions not specified)

Description: A vulnerability exists in the web-based management interface of Cisco Secure FMC Software that could allow an authenticated, low-privileged, remote attacker to access troubleshoot files for a different domain. This issue is due to missing authorization checks, allowing an attacker to directly access troubleshoot files belonging to other domains managed within the same Cisco Secure FMC instance. Successful exploitation could lead to the retrieval of sensitive information contained within these files.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-11006

CVE-2025-20301

Affected Products

Cisco Secure Fmc

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-authz-bypass-M7xhnAu · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-20301 · Security Note
• https://bdu.fstec.ru/vul/2025-11006 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-20301 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20301 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/1956045545249677500 · Twitter Post
• https://twitter.com/CVEnew/status/1956390319747924085 · Twitter Post
• https://t.me/CVEtracker/30011 · Telegram Post