Cross-Site Scripting Vulnerability in Cisco Secure Firewall Management Center Software
CVE-2025-20235

6.1MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Firepower Management Center
Vendor
CVE Published:
14 August 2025

Badges

👾 Exploit Exists

What is CVE-2025-20235?

A vulnerability exists in the web-based management interface of Cisco Secure Firewall Management Center Software, allowing an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack. This flaw results from inadequate validation of user-supplied input, enabling attackers to inject malicious scripts into various input fields. If successfully exploited, the attacker could run arbitrary scripts within the browser context of the affected interface, potentially leading to unauthorized access to sensitive information stored in the browser.

Affected Version(s)

Cisco Firepower Management Center 6.2.3.12

Cisco Firepower Management Center 6.2.3.1

Cisco Firepower Management Center 6.2.3.10

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.