CVE-2025-20337
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
In short
An unprotected API in Cisco ISE allows attackers to run malicious code on the system with full administrative privileges without needing any password or login. This is a critical security flaw because anyone on the internet can potentially take complete control of the device.
Technical detail
An unauthenticated remote attacker can exploit insufficient input validation in a specific Cisco ISE API endpoint to achieve arbitrary code execution with root privileges. The attack vector requires only a crafted API request with no pre-authentication required, resulting in complete system compromise.
Summary generated and translated by AI from the official description.
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Cisco · Cisco Identity Services Engine SoftwareCisco · Cisco ISE Passive Identity ConnectorWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →