CVE-2025-20281 | A vulnerability in a specific API of Cisco ISE and Cisco ISE… | CVSS 10.0 CRITICAL

Description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Metadata

CVE ID: CVE-2025-20281
State: PUBLISHED
Assigner: cisco
Reserved: 2024-10-10 19:15 UTC
Published: 2025-06-25 16:11 UTC
Last updated: 2026-02-26 17:50 UTC
Primary CWE: CWE-74
Improper Neutralization of Special Elements in Output Used b…
Vendor / Product: Cisco / Cisco Identity Services Engine Software
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: ACTIVE
Automatable: yes
Tech. Impact: total

CISA Known Exploited Vulnerability

Vulnerability name: Cisco Identity Services Engine Injection Vulnerability
Vendor: Cisco
Product: Identity Services Engine
Added to KEV: 2025-07-28
Due date: 2025-08-18
Ransomware: Not known

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA description

Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.

Affected products (1)

Vendor	Product	Platform	Versions
Cisco	Cisco Identity Services Engine Software	—	3.3.0, 3.3 Patch 2, 3.3 Patch 1, 3.3 Patch 3 …

Weakness (CWE)

CWE	Source	Description
CWE-74	cna	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (1)

cisco-sa-ise-unauth-rce-ZAd2GnJ6 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6