Actively exploited · Published Jun 25, 2025 · Assigned by cisco
CVE-2025-20281Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
Critical 10.0 Exploited
In plain English
A critical-severity injection in Cisco Identity Services Engine Software from Cisco. Attackers are actively exploiting it in the wild (listed by CISA on July 28, 2025). The chance it is exploited in the next 30 days is estimated at 97.6% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 18, 2025.
Official description
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Identity Services Engine Software | 3.3.03.3 Patch 23.3 Patch 13.3 Patch 33.4.03.3 Patch 43.4 Patch 13.3 Patch 5 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H