A essential vulnerability (CVE-2025-20337) in Cisco’s Id Providers Engine (ISE) might be exploited to let an unauthenticated attacker retailer malicious information, execute arbitrary code, or acquire root privileges on susceptible gadgets.
The safety situation acquired the utmost severity score, 10 out of 10, and is attributable to inadequate user-supplied enter validation checks.
It was found by Kentaro Kawane, a researcher on the Japanese cybersecurity service GMO Cybersecurity by Ierae, and reported Development Micro’s Zero Day Initiative (ZDI).
A distant unauthenticated attacker might leverage it by submitting a specifically crafted API request
The vulnerability was added through an replace to the safety bulletin for CVE-2025-20281 and CVE-2025-20282, two related RCE vulnerabilities that additionally acquired the utmost severity rating, that impression ISE and ISE-PIC variations 3.4 and three.3.
“These vulnerabilities have an effect on Cisco ISE and ISE-PIC releases 3.3 and three.4, no matter machine configuration,” the seller notes for CVE-2025-20281 and CVE-2025-20337, including that “these vulnerabilities don’t have an effect on Cisco ISE and ISE-PIC Launch 3.2 or earlier.”
Any of the three safety points may be exploited independently.
Cisco additionally warns that clients who utilized the patches for CVE-2025-20281 and CVE-2025-20282 will not be lined from CVE-2025-20337, and must improve to ISE 3.3 Patch 7 or ISE 3.4 Patch 2.
The product variations under are the one ones at present confirmed to deal with all three most severity vulnerabilities. Workarounds or different mitigations will not be accessible.
Cisco ISE or ISE-PIC Launch | First Mounted Launch for CVE-2025-20281 | First Mounted Launch for CVE-2025-20282 | First Mounted Launch for CVE-2025-20337 |
---|---|---|---|
3.2 and earlier | Not susceptible | Not susceptible | Not susceptible |
3.3 | 3.3 Patch 7 | Not susceptible | 3.3 Patch 7 |
3.4 | 3.4 Patch 2 | 3.4 Patch 2 | 3.4 Patch 2 |
Though no exploitation of any of the three essential vulnerabilities has been noticed within the wild as of but, it is suggested that system directors take rapid motion to mitigate the dangers.
Additionally yesterday, Cisco launched 4 safety advisories for much less extreme vulnerabilities (medium to excessive severity score) in a number of of its merchandise:
- CVE-2025-20274: Excessive-severity arbitrary file add vulnerability impacting Cisco Unified Intelligence Heart, together with Unified CCX bundles. Authenticated customers with Report Designer privileges can add malicious information and doubtlessly execute them as root. Mounted in variations 12.5(1) SU ES05 and 12.6(2) ES05.
- CVE-2025-20272: Medium-severity blind SQL injection vulnerability in Cisco Prime Infrastructure and EPNM. Low-privileged customers can exploit REST APIs to extract unauthorized database content material. Resolved in Prime Infrastructure 3.10.6 SU2 and EPNM variations 8.0.1 and eight.1.1.
- CVE-2025-20283, CVE-2025-20284, CVE-2025-20285: Medium-severity authenticated RCE and IP entry restriction bypass vulnerabilities in Cisco ISE and ISE-PIC. Excessive-privileged customers can execute instructions as root or log in from unauthorized IPs. Impacts variations 3.3 and three.4; fastened in 3.3 Patch 7 and three.4 Patch 2.
- CVE-2025-20288: Medium-severity SSRF vulnerability in Cisco Unified Intelligence Heart, exploitable with out authentication. Permits attackers to ship arbitrary inside requests through the affected system. Impacts variations 12.5 and 12.6, together with Unified CCX bundles. Mounted in 12.5(1) SU ES05 and 12.6(2) ES05.
Cisco notes that there no workarounds for any of the above vulnerabilities and advises clients to find out their danger publicity primarily based on the seller’s data and be sure that the gadgets have sufficient reminiscence earlier than contemplating an improve.
Moreover, directors ought to check and ensure that present configurations for {hardware} and software program elements are correctly supported by the newer Cisco product launch.
CISOs know that getting board buy-in begins with a transparent, strategic view of how cloud safety drives enterprise worth.
This free, editable board report deck helps safety leaders current danger, impression, and priorities in clear enterprise phrases. Flip safety updates into significant conversations and sooner decision-making within the boardroom.