Cisco Identity Services Engine Software 3.4.0 RADIUS comparison

Summaryinfo

A vulnerability identified as critical has been detected in Cisco Identity Services Engine Software 3.4.0. This issue affects some unknown processing of the component RADIUS. This manipulation causes comparison. This vulnerability is handled as CVE-2025-20343. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Cisco Identity Services Engine Software 3.4.0. Affected by this vulnerability is some unknown functionality of the component RADIUS. The manipulation with an unknown input leads to a comparison vulnerability. The CWE definition for the vulnerability is CWE-697. The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses. As an impact it is known to affect availability. The summary by CVE is:

A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.

It is possible to read the advisory at sec.cloudapps.cisco.com. This vulnerability is known as CVE-2025-20343 since 10/10/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/20/2025).

The vulnerability scanner Nessus provides a plugin with the ID 274062 (Cisco Identity Services Engine (cisco-sa-ise-radsupress-dos-8YF3JThh)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (274062) and EUVD (EUVD-2025-37893). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Policy Management Software

Vendor

• Cisco

Name

• Identity Services Engine Software

Version

• 3.4.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion