CVE-2025-20281
Cisco Identity Services Engine 3.3.0 … 3.4.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-20281 is a critical-severity Injection (CWE-74) vulnerability in Cisco Identity Services Engine. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC allows unauthenticated remote attackers to execute arbitrary code as root on the underlying operating system. The flaw stems from insufficient validation of user-supplied input and is tracked as CWE-74 with a CVSS score of 10.0.
An attacker can exploit the issue by submitting a crafted API request without any credentials, resulting in full root-level compromise of an affected device. The attack requires no user interaction and can be carried out remotely over the network.
The Cisco Security Advisory cisco-sa-ise-unauth-rce-ZAd2GnJ6 and CISA's Known Exploited Vulnerabilities catalog both address the issue, confirming active exploitation in the wild. The associated EPSS score has reached a peak of 0.3603 with a current value of 0.3348.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19167
Vulnerability Data
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this…
more
vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
- CWE(s)
- KEV Date Added
- 28 July 2025
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.1V1.2.3V1.2.5V1.2.8
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly requires validation of information inputs to reject malformed or special-element content before it reaches downstream parsers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and output encoding that prevent injection flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches injection vulnerabilities before release.
Logging supports detection of injection attempts but does not prevent the weakness.
Monitoring activities can identify active injection attacks after they occur.
Secure development life cycle mandates input validation and output encoding that directly prevent injection flaws.
Application security requirements explicitly call for controls against injection attacks in software design.
Secure architecture principles reduce injection surfaces but do not prescribe specific neutralization techniques.