CVE-2025-20286

The vulnerability (CWE-259: use of hard-coded passwords) results from an improper credential generation mechanism during Cisco ISE deployment on cloud platforms. All ISE instances running the same software version on the same cloud platform receive identical credentials. An attacker can extract these credentials from an ISE instance accessible to them and then use them to connect to other ISE instances via unsecured ports. The vulnerability applies only to deployments where the Primary Administration Node (PAN) is hosted in the cloud — deployments with on-premises PAN are not threatened.

Successful exploitation of the vulnerability allows an attacker to gain unauthorized access to sensitive data, execute limited administrative operations, modify system configurations, and disrupt services in affected ISE environments.

Apply patches available from the vendor according to the references: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-aws-static-cred-FPMjUcm7. As a remedial measure, verify whether the Primary Administration Node is deployed in the cloud, and if necessary, consider moving it to an on-premises environment. Also secure appropriate communication ports at the network level.

Cisco Identity Services Engine (ISE) deployed in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) clouds, where the Primary Administration Node is hosted in a cloud environment. Detailed information about affected versions available in vendor references.