EUVD-2025-19167CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
Analysis
Cisco ISE and ISE-PIC contain a critical input injection vulnerability (CVE-2025-20281, CVSS 10.0) that allows unauthenticated remote attackers to execute arbitrary code as root on the underlying operating system. With EPSS 30.4% and KEV listing, this vulnerability targets the network access control platform that governs who and what can access the enterprise network — compromising ISE means controlling network admission for the entire organization.
Technical Context
Cisco ISE (Identity Services Engine) is the central NAC (Network Access Control) platform that authenticates users and devices, enforces access policies, and controls who can connect to the network. The vulnerability exists in an API endpoint that does not require authentication and fails to properly validate user input. Successful exploitation provides root-level code execution on the ISE appliance. Compromise of ISE gives attackers control over network access policies for the entire organization.
Affected Products
['Cisco Identity Services Engine (ISE)', 'Cisco ISE Passive Identity Connector (ISE-PIC)']
Remediation
Apply Cisco security update IMMEDIATELY — emergency priority. Restrict API access to trusted management networks. Monitor ISE policy changes for unauthorized modifications. Audit network access logs for suspicious device admissions. Review RADIUS/TACACS configurations for tampering.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today