Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization

🚨SEVERITY: MEDIUM — CVSS 6.5Security Advisory

TL;DR 📌

  • Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to issue commands on the underlying operating system as the root user and allow IP access filters to be bypassed. Cisco has released software updates that address these vulnerabilities. There are no workarounds that…
  • Highest CVSS: 6.5 (Medium).
  • Fix available — see the first fixed release below.
  • CVEs: CVE-2025-20283, CVE-2025-20284, CVE-2025-20285.

What it is

This advisory covers three separate vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). None depend on each other, and a release affected by one is not necessarily affected by the others.

CVE-2025-20283 and CVE-2025-20284 sit in a specific API on ISE and ISE-PIC. Both stem from insufficient validation of user-supplied input. An attacker who already holds valid high-privileged credentials can submit a crafted API request and execute arbitrary commands on the underlying operating system as root. This is a network-reachable, authenticated attack against the API — no additional user interaction is needed once the attacker has credentials.

CVE-2025-20285 is a separate issue in the IP Access Restriction feature, which administrators use to limit which source IP addresses can reach the ISE admin portal and services. Improper enforcement of these controls means an authenticated attacker with valid administrative credentials can log in to the API from an IP address that should have been blocked, effectively bypassing the restriction. This only affects deployments where IP Access Restriction is enabled; CVE-2025-20283 and CVE-2025-20284 affect ISE and ISE-PIC regardless of configuration.

In all three cases the prerequisite is valid, high-privileged (CVE-2025-20283/20284) or administrative (CVE-2025-20285) credentials — these are not unauthenticated, pre-auth flaws. Cisco has not indicated any public exploitation or malicious use of these issues.

What to do

  • Cisco ISE and ISE-PIC releases 3.2 and earlier are not vulnerable to these issues; Cisco’s guidance for those is to migrate to a fixed release.
  • On 3.3, upgrade to 3.3 Patch 7 — this addresses CVE-2025-20283, CVE-2025-20284 and CVE-2025-20285.
  • On 3.4, upgrade to 3.4 Patch 2 — this also addresses all three CVEs.
  • There are no workarounds for any of these vulnerabilities, so patching is the only remediation path.
  • Given all three flaws require authenticated access, review who holds high-privileged and administrative credentials on ISE/ISE-PIC and tighten credential hygiene while patches are rolled out.
  • If you rely on IP Access Restriction to limit admin portal access, treat that control as bypassable until Patch 7 (3.3) or Patch 2 (3.4) is applied, and don’t treat it as a substitute for credential security in the interim.

Fixed releases

Affected release First fixed release
3.3 3.3 Patch 7
3.4 3.4 Patch 2

For leadership 🧭

Executive summary. Risk is Medium (CVSS 6.5) across any Cisco kit you run. Vendor fixes are available; prioritise upgrade within 30 days.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: upgrade to the first fixed release in the table above, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source