CVE-2025-20282
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Description
A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.
Weakness: CWE-269
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Identity Services Engine (ISE) Check your version | Identity / IAM / MFA | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Identity Services Engine Software
Vendor advisory
cisco-sa-ise-unauth-rce-ZAd2GnJ6
Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities
Cisco’s rating: Critical (advisory CVSS 10.0) · Published Jun 25, 2025 · updated Jul 24, 2025 (revision 2.2)
Bug IDs: CSCwo99449 , CSCwp02814 , CSCwp02821
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from