Cisco fixed critical ISE flaws allowing Root
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-20281 +1 in the same advisory: …20282 | Unauthenticated Root RCE via API Injection in Cisco ISE and ISE-PIC CVE-2025-20281 is an injection flaw (CWE-74) in a specific API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), caused by insufficient validation of user-supplied input. An unauthenticated, remote attacker can trigger it by sending a crafted request to that API; no valid credentials or user interaction are required. A successful exploit yields arbitrary code execution on the underlying operating system with root privileges, giving the attacker full control of the affected device (scope-changing per the CVSS 10.0 score). Any organization running affected ISE or ISE-PIC releases is exposed, particularly where the vulnerable API is reachable from untrusted networks. The flaw is confirmed under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-07-28, EPSS assigns a 97.1% probability of exploitation within 30 days, and ZDI has published a writeup of the unauthenticated root RCE. Do: Upgrade Cisco ISE and ISE-PIC to the patched releases specified in Cisco's PSIRT advisory, and check whether the vulnerable API/admin interface is reachable from untrusted networks, restricting access until patching is complete. As a KEV entry added 2025-07-28, U.S. federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use of the product; given EPSS of 97.1% and confirmed active exploitation, prioritize internet-facing ISE instances and review API/web-server logs for signs of exploitation. | 10.0 | 97% | KEV PoC |
| largeroughly tens of thousands of enterprise/government deployments worldwide (estimate), with an unknown subset exposing the vulnerable API to untrusted networks |
Full article371 words · extracted from securityaffairs.com · click to collapse
Cisco released patches to address two critical vulnerabilities in ISE and ISE-PIC that could let remote attackers execute to code as root.
Cisco addressed two critical vulnerabilities, tracked as CVE-2025-20281 and CVE-2025-20282, in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that could allow remote, unauthenticated attackers to execute arbitrary code with root privileges.
“Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to issue commands on the underlying operating system as the root user.” reads the advisory.
CVE-2025-20281 (CVSS score of 10) affects Cisco ISE/ISE-PIC 3.3+, while CVE-2025-20282 (CVSS score of 10) impacts only version 3.4. Versions outside these ranges are not impacted.
CVE-2025-20281 is a critical flaw in Cisco ISE/ISE-PIC allowing unauthenticated remote attackers to execute code as root via a vulnerable API.
“This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request.” continues the advisory. “A successful exploit could allow the attacker to obtain root privileges on an affected device.”
The second flaw, tracked as CVE-2025-20282, is a critical issue in Cisco ISE/ISE-PIC allowing unauthenticated remote attackers to upload and execute files as root via an internal API.
“This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device.” reads the advisory. “A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.”
The IT giant states that there are no workarounds that address these vulnerabilities.
The following table includes fixed releases:
| Cisco ISE or ISE-PIC Release | First Fixed Release for CVE-2025-20281 | First Fixed Release for CVE-2025-20282 |
|---|---|---|
| 3.2 and earlier | Not vulnerable | Not vulnerable |
| 3.3 | 3.3 Patch 6 ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz | Not vulnerable |
| 3.4 | 3.4 Patch 2 ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz | 3.4 Patch 2 ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz |
The company’s Product Security Incident Response Team (PSIRT) is not aware of attacks in the wild exploiting these vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Cisco)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/179362/security/cisco-fixed-critical-ise-flaws-allowing-root-level-rce.html