Cisco Identity Services Engine Software 3.3.0/3.4.0 API injection

Summaryinfo

A vulnerability labeled as critical has been found in Cisco Identity Services Engine Software 3.3.0/3.4.0. Impacted is an unknown function of the component API. The manipulation results in injection. This vulnerability is known as CVE-2025-20281. It is possible to launch the attack remotely. Furthermore, an exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Cisco Identity Services Engine Software 3.3.0/3.4.0. It has been classified as critical. Affected is an unknown part of the component API. The manipulation with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

The advisory is available at sec.cloudapps.cisco.com. This vulnerability is traded as CVE-2025-20281 since 10/10/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but an exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/29/2025). This vulnerability is assigned to T1055 by the MITRE ATT&CK project.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 240470 (Cisco Identity Services Engine (cisco-sa-ise-unauth-rce-ZAd2GnJ6)), which helps to determine the existence of the flaw in a target environment. This issue was added on 07/28/2025 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 08/18/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (240470) and EUVD (EUVD-2025-19167). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Policy Management Software

Vendor

• Cisco

Name

• Identity Services Engine Software

Version

• 3.3.0
• 3.4.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion