Cisco Identity Services Engine Software 3.3.0/3.4.0 API injection

Summaryinfo

A vulnerability identified as problematic has been detected in Cisco Identity Services Engine Software 3.3.0/3.4.0. Affected is an unknown function of the component API Handler. Performing a manipulation results in injection. This vulnerability is cataloged as CVE-2025-20283. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Identity Services Engine Software 3.3.0/3.4.0. It has been classified as problematic. This affects some unknown functionality of the component API Handler. The manipulation with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, the attacker must have valid high-privileged credentials.

The advisory is shared at sec.cloudapps.cisco.com. This vulnerability is uniquely identified as CVE-2025-20283 since 10/10/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/22/2025). MITRE ATT&CK project uses the attack technique T1055 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 242172 (Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-3VpsXOxO)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (242172) and EUVD (EUVD-2025-21712). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Policy Management Software

Vendor

• Cisco

Name

• Identity Services Engine Software

Version

• 3.3.0
• 3.4.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion