CVE-2025-20337

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

En bref

Sévérité: CRITICAL 10.0
Exploitation: Exploitation connue (CISA KEV) · ajoutée le 2025-07-28
Exploitée selon l'ENISA depuis le 2025-07-28
EPSS: EPSS 74.50 % · centile 99 (2026-10-27)
État: PUBLISHED
Publiée: 2025-07-16
Mise à jour: 2026-02-26
Attribuée par: cisco
Statut NVD: Analyzed

Description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	cisco
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	NVD · psirt@cisco.com (Secondary)

Faiblesses (CWE)

CWE-74

Références européennes

ENISA EUVD · EUVD-2025-21708
GCVE · GCVE-0-2025-20337

Avis du CERT-FR

CERTFR-2025-AVI-0539 — Multiples vulnérabilités dans Cisco Identity Services Engine · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:-:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch1:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch2:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch3:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch4:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch5:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch6:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:-:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch1:*:*:*:*:*:*

Produits affectés

Produit	Versions
Cisco · Cisco Identity Services Engine Software	affected 3.3.0 ; affected 3.3 Patch 2 ; affected 3.3 Patch 1 ; affected 3.3 Patch 3 ; affected 3.4.0 ; affected 3.3 Patch 4
Cisco · Cisco ISE Passive Identity Connector	affected 3.2.0 ; affected 3.1.0 ; affected 3.3.0 ; affected 3.4.0

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD