Cisco Identity Services Engine RADIUS Suppression Denial of Service Vulnerability

TL;DR 📌

• A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a…
• Highest CVSS: 8.6 (High).
• Fix available — see the first fixed release below.
• CVEs: CVE-2025-20343.

What it is

CVE-2025-20343 is a denial-of-service flaw in Cisco Identity Services Engine (ISE), tied to the RADIUS setting “Reject RADIUS requests from clients with repeated failures.” This setting is new in ISE 3.4.0 and is enabled by default.

The bug is a logic error in how ISE handles a RADIUS access request for a MAC address that is already marked as a rejected endpoint. By sending a specific sequence of multiple crafted RADIUS access request messages, an unauthenticated, remote attacker can trigger this condition and cause ISE to restart. Because the affected setting sits in the RADIUS request-processing path rather than the management UI, exploitation is via the RADIUS data plane, not an administrative interface.

The vulnerability affects ISE releases 3.4.0, 3.4 Patch 1, 3.4 Patch 2, and 3.4 Patch 3, where the suppression setting is enabled by default. Cisco ISE Passive Identity Connector (ISE-PIC) is confirmed not vulnerable, as are ISE 3.3 and earlier and ISE 3.5. The CVSS score is 8.6 (High), reflecting low attack complexity, no privileges or user interaction required, and network attack vector. Cisco PSIRT states it is not aware of any public announcements or malicious use of this vulnerability.

What to do

• Upgrade affected ISE 3.4 deployments to 3.4 Patch 4, the first fixed release.
• If you cannot patch immediately, disable the workaround setting: in the ISE web UI go to Administration > System > Settings > Protocols > RADIUS, find “Suppress Repeated Failed Clients and repeated accounting,” and uncheck “Reject RADIUS requests from clients with repeated failures.” This removes the exposure but changes suppression behaviour, so assess the effect on your RADIUS client handling first.
• Check your configuration state now: this setting is on by default in the affected releases, so most 3.4.0–3.4 Patch 3 deployments should be assumed vulnerable unless verified otherwise.
• After upgrading to Patch 4, re-enable the suppression setting if you had disabled it as a temporary workaround — Cisco recommends this once the fix is applied.
• ISE 3.3 and earlier, and ISE 3.5, are not vulnerable and require no action for this issue.

Fixed releases

For leadership 🧭

Executive summary. Risk is High (CVSS 8.6) across any Cisco kit you run. Vendor fixes are available; prioritise upgrade within 7 days.

Why it matters:

• Exposure depends on deployment topology and which access paths reach the affected component.
• Treat internet-facing and management-plane instances as higher risk than internal-only ones.
• Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

• Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
• Next: upgrade to the first fixed release in the table above, through an approved change window.
• Later: add a control check so builds cannot drift back onto a vulnerable train.

Source

• Cisco advisory
• CVE-2025-20343 on NVD