Cisco Identity Services Engine Software 3.4.0 Internal API privileges management

Summaryinfo

A vulnerability classified as critical has been found in Cisco Identity Services Engine Software 3.4.0. This affects an unknown function of the component Internal API. Performing a manipulation results in privileges management. This vulnerability was named CVE-2025-20282. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical has been found in Cisco Identity Services Engine Software 3.4.0. This affects some unknown processing of the component Internal API. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.

The advisory is shared at sec.cloudapps.cisco.com. This vulnerability is uniquely identified as CVE-2025-20282 since 10/10/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/26/2025). MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 240417 (Cisco Identity Services Engine (cisco-sa-ise-unauth-rce-ZAd2GnJ6)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (240417) and EUVD (EUVD-2025-19166). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Policy Management Software

Vendor

• Cisco

Name

• Identity Services Engine Software

Version

• 3.4.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion