Cisco Identity Services Engine RADIUS Denial of Service Vulnerability
TL;DR 📌
- A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by sending a specific authentication request…
- Highest CVSS: 8.6 (High).
- Fix available — see the first fixed release below.
- CVEs: CVE-2025-20152.
What it is
CVE-2025-20152 is a denial of service flaw in the RADIUS message processing feature of Cisco Identity Services Engine (ISE). It is caused by improper handling of certain RADIUS requests.
The attack path is via a network access device (NAD) that uses Cisco ISE for AAA (authentication, authorization, and accounting). An unauthenticated, remote attacker sends a specific authentication request to a NAD configured to use ISE for RADIUS authentication. This request reaches ISE’s RADIUS processing and causes the ISE process to reload — a full service interruption for authentication, not a partial degradation.
Because RADIUS services are enabled by default on Cisco ISE, any deployment that hasn’t explicitly disabled RADIUS AAA is in scope. Cisco notes that if ISE is being used only for TACACS+, the device is not affected by this vulnerability. No authentication or prior access to ISE itself is required — the attacker only needs the ability to send crafted RADIUS traffic to a NAD that’s pointed at the vulnerable ISE instance.
The CVSS score is 8.6 (High), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on availability with no impact on confidentiality or integrity.
What to do
- Upgrade Cisco ISE 3.4 to the fixed release 3.4P1. Cisco lists 3.3 and earlier as not vulnerable.
- Confirm whether your ISE deployment has RADIUS AAA enabled — it is on by default. If ISE is used solely for TACACS+, the corresponding NAD is not affected.
- There are no workarounds for this vulnerability; patching is the only mitigation Cisco offers.
- Consult the advisory (cisco-sa-ise-restart-ss-uf986G2Q) for full release mapping before planning the upgrade, and use Cisco’s Upgrade Guides for ISE when scheduling the change given the reload impact.
Fixed releases
| Affected release | First fixed release |
|---|---|
| 3.4 | 3.4P1 |
For leadership 🧭
Executive summary. Any network access device relying on Cisco ISE for RADIUS authentication can be forced offline by a single crafted request, with no credentials required by the attacker. Since ISE 3.4 is affected and no workaround exists, this needs patching to 3.4P1 on the next available change window rather than left open.
Why it matters:
- RADIUS AAA is enabled on Cisco ISE by default, so any deployment that hasn’t explicitly turned it off is exposed to this issue.
- An unauthenticated attacker only needs the ability to reach a network access device pointed at a vulnerable ISE instance – no access to ISE itself is needed.
- A successful request causes the ISE process to reload, meaning a full interruption of authentication, authorisation and accounting services rather than a partial slowdown.
- Cisco has published no workaround, so exposure remains until the fixed release is installed.
Now / Next / Later:
- Now: Check whether RADIUS AAA is enabled on your Cisco ISE deployment (it is by default) and confirm which ISE release you are running against the fixed-release table in the advisory.
- Next: Upgrade Cisco ISE 3.4 deployments to 3.4P1 in a scheduled change window, following Cisco’s ISE Upgrade Guides given the reload impact during the process.
- Later: Where ISE is only needed for TACACS+, disable RADIUS AAA services to remove this attack path entirely, and build ISE patch tracking into routine change management since no workaround exists for issues like this.