CVE-2025-20337

The vulnerability results from insufficient validation of user-supplied data in a specific product API interface (CWE-74 — injection). An attacker can submit a specially crafted request to the vulnerable API without needing authentication. Successful exploitation of the vulnerability leads to arbitrary code execution at the operating system level with root privileges.

The attacker gains full control over the device's operating system with root privileges, enabling arbitrary modification of configuration, theft of credentials and sensitive information stored by Cisco ISE, as well as further lateral movement in the network.

Patches available from the manufacturer should be applied immediately in accordance with the references — detailed information about vulnerable and patched versions is contained in the Cisco Security Advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6. Until the patch is deployed, it is recommended to restrict access to Cisco ISE API interfaces exclusively to trusted hosts and to monitor network traffic for suspicious API requests.

Cisco Identity Services Engine (ISE) and Cisco Identity Services Engine Passive Identity Connector (ISE-PIC) — specific versions indicated in the manufacturer's references (Cisco Security Advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.