Analysis Summary

Cisco has released security patches for two critical vulnerabilities affecting its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), which could allow unauthenticated remote code execution (RCE). The flaws, identified as CVE-2025-20281 and CVE-2025-20282, both carry the maximum CVSS severity score of 10.0 and can be exploited independently of each other.

CVE-2025-20281 arises due to insufficient validation of user-supplied input in specific APIs. This flaw enables unauthenticated attackers to send crafted API requests that result in the execution of arbitrary code with root privileges on the affected system. It impacts ISE and ISE-PIC versions 3.3 and later, and has been resolved in ISE/ISE-PIC 3.3 patch 6 and 3.4 patch 2.

CVE-2025-20282 is caused by the lack of file validation checks, allowing attackers to upload malicious files to privileged directories. Successful exploitation enables arbitrary code execution or privilege escalation to root level. This flaw specifically affects ISE and ISE-PIC release 3.4, and is also addressed in version 3.4 patch 2.

Cisco emphasizes that the vulnerabilities are not interdependent, and systems affected by one may not necessarily be impacted by the other. It urges users to immediately apply the patches due to the high-risk nature of the vulnerabilities.

Additionally, Cisco has patched a medium-severity flaw in ISE that could let remote attackers bypass authorization mechanisms and alter system settings, potentially triggering a system restart.

At this time, no active exploitation of these vulnerabilities has been observed in the wild. More details and guidance can be found on Cisco’s official security advisories page. Organizations using affected ISE versions are strongly advised to prioritize updates to mitigate the risks.

Impact

• Remote Code Execution
• Privilege Escalation
• Unauthorized Access

Indicators of Compromise

CVE

• CVE-2025-20282

• CVE-2025-20281

Remediation

• Refer to Cisco Security Advisory for patch, upgrade, or suggested workaround information.
• Restrict API access to internal networks only and block public access using firewalls.
• Validate all user input to prevent malicious requests from reaching the system.
• Regularly monitor system and API logs to detect suspicious activity.
• Enable file integrity monitoring to identify unauthorized file changes.
• Limit each user and service to only the permissions they truly need.
• Audit system configurations and disable insecure default options.
• Include regular vulnerability scans and penetration testing in your security routine.
• Disable or restrict any unused APIs and services to reduce the attack surface.
• Subscribe to Cisco PSIRT alerts to receive timely security patch updates.
• Train network and system administrators on secure API usage and file handling.
• Maintain regular backups of configurations and critical data for recovery.
• Use intrusion detection and prevention tools to catch threats in real time.
• Secure physical access to devices to avoid local exploitation risks.