CVE-2025-20281
Last modified
CVE-2025-20281 is a critical-severity vulnerability rated 10/10 on the CVSS scale. A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. CISA has confirmed active exploitation in the wild. EPSS estimates a 96.73% chance of exploitation in the next 30 days.
Description
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Identity Services Engine | 3.3.0 |
| Cisco | Identity Services Engine | 3.4.0 |
| Cisco | Identity Services Engine Passive Identity Connector | 3.3.0 |
| Cisco | Identity Services Engine Passive Identity Connector | 3.4.0 |
References
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-20281?
How severe is CVE-2025-20281?
How do I fix CVE-2025-20281?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-20276A vulnerability in the web-based management interface of Cis…7.2
- CVE-2025-20277A vulnerability in the web-based management interface of Cis…6.7
- CVE-2025-20278A vulnerability in the CLI of multiple Cisco Unified Communi…6.7
- CVE-2025-20279A vulnerability in the web-based management interface of Cis…4.8
- CVE-2025-2028Lack of TLS validation when downloading a CSV file including…5.3
- CVE-2025-20280A vulnerability in the web-based management interface of Cis…4.8
- CVE-2025-20282A vulnerability in an internal API of Cisco ISE and Cisco IS…10
- CVE-2025-20283A vulnerability in a specific API of Cisco ISE and Cisco ISE…7.2
- CVE-2025-20284A vulnerability in a specific API of Cisco ISE and Cisco ISE…7.2
- CVE-2025-20285A vulnerability in the IP Access Restriction feature of Cisc…4.1
- CVE-2025-20286A vulnerability in Amazon Web Services (AWS), Microsoft Azur…9.8
- CVE-2025-20287A vulnerability in the web-based management interface of Cis…8.8
Are you affected by CVE-2025-20281?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST