Cisco Identity Services Engine Arbitrary File Upload Vulnerability
TL;DR 📌
- A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy function. An attacker could exploit this vulnerability by sending a crafted file upload using the Cisco ISE…
- Highest CVSS: 4.9 (Medium).
- Fix available — see the first fixed release below.
- CVEs: CVE-2025-20131.
What it is
CVE-2025-20131 is an arbitrary file upload flaw in the GUI of Cisco Identity Services Engine (ISE). It stems from improper validation in the file copy function that handles uploads submitted through the admin interface.
Exploitation requires network access to the ISE GUI and authentication with administrative privileges — this is not an unauthenticated bug. An admin-level attacker can submit a crafted file upload via the GUI’s file copy feature, causing the system to write arbitrary files to the underlying device. Cisco’s advisory notes this affects Cisco ISE regardless of device configuration.
The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) confirms network-based access, low attack complexity, high privileges required, no user interaction, and an integrity impact with no confidentiality or availability loss recorded. The base score is 4.9 (Medium), reflecting the privilege requirement that limits who can reach this.
There are no workarounds. Cisco has released fixed software.
What to do
- Upgrade Cisco ISE to the first fixed release for your train: 3.2 P7 for the 3.2 branch, 3.3 P3 for the 3.3 branch. Cisco’s table also lists 3.1 P10 as the fix for 3.1 and earlier, and states 3.4 is not vulnerable — check the advisory for your exact current version against that table.
- Since there is no workaround, patching is the only mitigation; there’s no interim configuration change to reduce exposure.
- In the meantime, tighten who holds administrative rights on ISE and review admin account access, since exploitation requires an authenticated admin session against the GUI.
- Audit GUI admin access logs for unexpected file upload activity via the file copy function, particularly from accounts that shouldn’t be performing that action.
Fixed releases
| Affected release | First fixed release |
|---|---|
| 3.2 | 3.2 P7 |
| 3.3 | 3.3 P3 |
For leadership 🧭
Executive summary. A Cisco ISE admin session can be used to push arbitrary files onto the appliance through a validation gap in the GUI’s file upload feature, threatening the integrity of network access control infrastructure. There’s no workaround, so remediation depends entirely on scheduling the vendor patch and tightening who holds admin rights in the meantime.
Why it matters:
- Cisco ISE is the policy engine controlling network access decisions, so arbitrary file writes on the device could undermine the integrity of that control point.
- The flaw sits in the admin GUI’s file copy function, meaning any account with administrative privileges on ISE is a potential exploitation path, not just a hardened perimeter.
- Cisco states this affects ISE regardless of device configuration, so there’s no configuration-based way to rule out exposure.
- With no workaround published, organisations are dependent on patching against a specific fixed-release table (3.1 P10, 3.2 P7, 3.3 P3; 3.4 not vulnerable) to close the gap.
Now / Next / Later:
- Now: Check your running Cisco ISE version against Cisco’s fixed-release table and identify which branch (3.1, 3.2, or 3.3) needs the patch, or confirm you’re already on 3.4.
- Next: Schedule an upgrade to the first fixed release for your branch — 3.2 P7 or 3.3 P3 — in the next maintenance window, since no interim workaround exists.
- Later: Review and tighten administrative access to the ISE GUI, and add auditing of file-copy/upload activity in admin logs so unusual use of that function by privileged accounts is caught going forward.