Cisco has launched updates to handle two maximum-severity security flaws in Id Providers Engine (ISE) and ISE Passive Id Connector (ISE-PIC) that would allow an unauthenticated attacker to execute arbitrary instructions as the foundation person.
The vulnerabilities, assigned the CVE identifiers CVE-2025-20281 and CVE-2025-20282, carry a CVSS rating of 10.0 every. An outline of the defects is under –
- CVE-2025-20281 – An unauthenticated distant code execution vulnerability affecting Cisco ISE and ISE-PIC releases 3.3 and later that would enable an unauthenticated, distant attacker to execute arbitrary code on the underlying working system as root
- CVE-2025-20282 – An unauthenticated distant code execution vulnerability affecting Cisco ISE and ISE-PIC launch 3.4 that would enable an unauthenticated, distant attacker to add arbitrary information to an affected machine and execute these information on the underlying working system as root
Cisco mentioned CVE-2025-20281 is the results of inadequate validation of user-supplied enter, which an attacker may exploit by sending a crafted API request to acquire elevated privileges and run instructions.
In distinction, CVE-2025-20282 stems from an absence of file validation checks that will in any other case forestall the uploaded information from being positioned in privileged directories.
“A profitable exploit may enable the attacker to retailer malicious information on the affected system after which execute arbitrary code or get hold of root privileges on the system,” Cisco mentioned.
The networking tools vendor mentioned there aren’t any workarounds that deal with the problems. The shortcomings have been addressed within the under variations –
- CVE-2025-20281 – Cisco ISE or ISE-PIC 3.3 Patch 6 (ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz), 3.4 Patch 2 (ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz)
- CVE-2025-20282 – Cisco ISE or ISE-PIC 3.4 Patch 2 (ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz)
The corporate credited Bobby Gould of Development Micro Zero Day Initiative and Kentaro Kawane of GMO Cybersecurity for reporting CVE-2025-20281. Kawane, who beforehand reported CVE-2025-20286 (CVSS rating: 9.9), has additionally been acknowledged for reporting CVE-2025-20282.
Whereas there isn’t any proof that the vulnerabilities have been exploited within the wild, it is important that customers transfer shortly to use the fixes to safeguard towards potential threats.
