CVE-2025-20285
Cisco Identity Services Engine ≤ 3.3.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:NSummary
CVE-2025-20285 is a medium-severity Authentication Bypass by Assumed-Immutable Data (CWE-302) vulnerability in Cisco Identity Services Engine. Its CVSS base score is 4.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21709
Vulnerability Data
A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP access restrictions and log in to the device from a disallowed IP address. This vulnerability is…
more
due to improper enforcement of access controls that are configured using the IP Access Restriction feature. An attacker could exploit this vulnerability by logging in to the API from an unauthorized source IP address. A successful exploit could allow the attacker to gain access to the targeted device from an IP address that should have been restricted. To exploit this vulnerability, the attacker must have valid administrative credentials.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V7.2.4
Mitigating Controls (NIST 800-53 r5) AI
Mandates proper unique identification and authentication of users, precluding reliance on attacker-controlled immutable assumptions.
Requires server-side enforcement of authorizations instead of trusting client-supplied mutable data for authentication decisions.
Mandates proper identification and authentication for non-organizational users, precluding reliance on attacker-controlled immutable assumptions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Strong authentication mechanisms directly avoid reliance on attacker-controlled immutable data.
Protecting and verifying identity assertions prevents tampering with data assumed immutable during auth.
Least-privilege authorization policies reduce impact of bypassed authentication but do not address the root flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover and block authentication bypasses that rely on mutable data.
Access-control policy can mandate validation of all identity data, reducing reliance on assumed-immutable fields.
Identity-management processes can require verification of mutable attributes, mitigating the root cause.
Proper management of authentication information prevents use of client-controlled tokens or cookies as sole proof of identity.
Access-rights reviews can detect and revoke rights granted via tampered immutable data.
Secure SDLC practices include threat modeling and input-validation requirements that catch assumed-immutable data flaws.