Cisco Identity Services Engine Software 3.3.0/3.4.0 API injection

Summaryinfo

A vulnerability was found in Cisco Identity Services Engine Software 3.3.0/3.4.0. It has been rated as problematic. This affects an unknown function of the component API Handler. This manipulation causes injection. This vulnerability is tracked as CVE-2025-20284. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Cisco Identity Services Engine Software 3.3.0/3.4.0 and classified as problematic. Affected by this vulnerability is an unknown function of the component API Handler. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, the attacker must have valid high-privileged credentials.

It is possible to read the advisory at sec.cloudapps.cisco.com. This vulnerability is known as CVE-2025-20284 since 10/10/2024. The exploitation appears to be easy. The attack can be launched remotely. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/22/2025). The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 242172 (Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-3VpsXOxO)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (242172) and EUVD (EUVD-2025-21711). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Policy Management Software

Vendor

• Cisco

Name

• Identity Services Engine Software

Version

• 3.3.0
• 3.4.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion