Live › vulnerability › CVE-2025-20281
Go to dashboardCisco Identity Services Engine (ISE) and ISE-PIC have an injection flaw in a specific API that does not validate user input. A remote attacker who sends a crafted API request can run commands and gain root on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cisco Identity Services Engine | vendor | – | – |
| cisco identity services engine | vendor | = 3.3.0 | – |
| cisco identity services engine | vendor | = 3.4.0 | – |
| cisco identity services engine passive identity connector | vendor | = 3.3.0 | – |
| cisco identity services engine passive identity connector | vendor | = 3.4.0 | – |
Unknown from the sources.
Apply the mitigations and fixed release from Cisco's advisory, as CISA requires; the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2025-20281")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.