CVE-2025-20302: Cisco Secure FMC Authorization Bypass

CVE-2025-20302 Overview

CVE-2025-20302 is a missing authorization vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software. An authenticated, low-privileged remote attacker can retrieve generated report files from a domain other than the one they are assigned to on the same FMC instance. The flaw stems from absent authorization checks when accessing stored report resources. Successful exploitation discloses activity recorded in a different administrative domain, breaking the multi-tenant isolation model that FMC relies on. The weakness is tracked as [CWE-862] Missing Authorization and affects a wide range of FMC releases from the 6.2.3 branch through 7.6.0.

Critical Impact
A low-privileged user in one FMC domain can read reports generated for other domains on the same appliance, exposing firewall activity and operational data across tenant boundaries.

Affected Products

Cisco Secure Firewall Management Center 6.2.3 through 6.2.3.18
Cisco Secure Firewall Management Center 6.4.0 through 7.2.9
Cisco Secure Firewall Management Center 7.3.0 through 7.6.0

Discovery Timeline

2025-08-14 - CVE-2025-20302 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20302

Vulnerability Analysis

Cisco Secure FMC supports multi-domain management, allowing administrators to segment policy, device, and reporting data across logical tenants. The web interface generates and stores report files that are intended to be visible only to users whose role grants access to the originating domain. CVE-2025-20302 breaks that boundary by failing to validate the requesting user's domain membership before returning a stored report. An attacker who already holds any authenticated low-privileged account on the FMC can enumerate or guess report identifiers and retrieve content belonging to other domains.

The disclosed data is limited to the contents of previously generated reports, which can include traffic summaries, intrusion events, policy hit counts, and other firewall telemetry. Integrity and availability are not affected, but confidentiality of recorded activity is directly impacted across tenant boundaries.

Root Cause

The root cause is a missing authorization check [CWE-862] in the report retrieval code path of the FMC web management interface. The handler verifies that the caller is authenticated but does not confirm that the target report belongs to a domain the caller is permitted to view. Access control is therefore enforced only at the UI listing layer, not at the direct resource endpoint.

Attack Vector

Exploitation requires network reachability to the FMC web interface and valid credentials for any user account with report-viewing privileges in at least one domain. The attacker issues a direct HTTP request to the report file resource using an identifier that corresponds to a report generated in another domain. Because the server does not re-check domain scope, the file is returned. No user interaction is required and the attack complexity is low. No public exploit code or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-20302

Indicators of Compromise

Web server access logs on the FMC showing authenticated requests to report download endpoints for report IDs that do not correspond to the user's assigned domain.
Anomalous volumes of report retrieval requests from a single low-privileged account, particularly sequential or enumerated report identifiers.
Report access events in audit logs where the requesting user's domain does not match the domain associated with the report metadata.

Detection Strategies

Correlate FMC audit log entries with user-to-domain mappings and alert on any report access where the user has no legitimate role in the report's originating domain.
Baseline normal report retrieval behavior per account and flag deviations such as off-hours access, bulk downloads, or access by accounts that rarely use reporting features.
Monitor for HTTP responses returning report payloads to session identifiers tied to non-privileged roles.

Monitoring Recommendations

Forward FMC /var/log web and audit logs to a centralized logging platform and retain them for retrospective analysis.
Enable detailed accounting on the FMC web interface so that report resource identifiers are captured in request logs.
Review privileged and low-privileged account activity following any FMC credential compromise, since this flaw expands the blast radius of a stolen account across domains.

How to Mitigate CVE-2025-20302

Immediate Actions Required

Inventory all Cisco Secure FMC instances and identify versions matching the affected release list, including 6.2.3, 6.4, 6.6, 7.0, 7.1, 7.2, 7.3, 7.4, and 7.6.0 trains.
Apply the fixed FMC software release identified in the Cisco Security Advisory cisco-sa-fmc-authz-bypass-M7xhnAu.
Audit existing FMC user accounts, remove unused low-privileged accounts, and rotate credentials for any account whose integrity cannot be verified.
Review historical report access logs for signs of cross-domain retrieval prior to patching.

Patch Information

Cisco has published a security advisory and fixed software for this vulnerability. Refer to the Cisco Security Advisory for the specific fixed release matrix that corresponds to each affected train. No workaround is documented by Cisco; upgrading to a fixed release is the required remediation.

Workarounds

Restrict network access to the FMC web management interface to a dedicated management network and trusted administrative hosts only.
Minimize the number of accounts provisioned on shared multi-domain FMC instances and apply least-privilege role assignments.
Enforce multi-factor authentication for all FMC administrative access to reduce the risk of low-privileged account compromise that could be leveraged for cross-domain data access.

bash

# Configuration example: restrict FMC web UI exposure at the perimeter
# Example iptables rule to limit management interface access to a jump host
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.5/32 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP