Cisco Firepower Management Center Software RCE (cisco-sa-fmc-radius-rce-TNBKf79)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(253650);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/08/22");

  script_cve_id("CVE-2025-20265");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo91250");
  script_xref(name:"CISCO-SA", value:"cisco-sa-fmc-radius-rce-TNBKf79");
  script_xref(name:"IAVA", value:"2025-A-0612");

  script_name(english:"Cisco Firepower Management Center Software RCE (cisco-sa-fmc-radius-rce-TNBKf79)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could
allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device. This
vulnerability is due to a lack of proper handling of user input during the authentication phase. An attacker could
exploit this vulnerability by sending crafted input when entering credentials that will be authenticated at the
configured RADIUS server. A successful exploit could allow the attacker to execute commands at a high privilege level.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-radius-rce-TNBKf79
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?68f29823");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo91250");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwo91250");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20265");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:firepower_management_center");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_firepower_version.nasl");
  script_require_keys("Host/Cisco/firepower_mc/version");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(
  app:'Cisco Firepower Management Center',
  kb_ver:'Host/Cisco/firepower_mc/version'
);

vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  {'equal':'7.0.7', 'fixed_display':'See Cisco bug ID CSCwo91250'},
  {'equal':'7.7.0', 'fixed_display':'See Cisco bug ID CSCwo91250'}
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE,
  require_paranoia: true
);