CVE-2025-20343
Cisco Identity Services Engine 3.4.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HSummary
CVE-2025-20343 is a high-severity Incorrect Comparison (CWE-697) vulnerability in Cisco Identity Services Engine. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Obfuscated Files or Information (T1027); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-20343 is a denial-of-service vulnerability in the RADIUS setting "Reject RADIUS requests from clients with repeated failures" within Cisco Identity Services Engine (ISE). The issue stems from a logic error during the processing of a RADIUS access request for a MAC address that is already classified as a rejected endpoint. This flaw, associated with CWE-697 and scored 8.6 on the CVSS v3.1 scale (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), can cause Cisco ISE to restart unexpectedly when exploited.
An unauthenticated, remote attacker can exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to the targeted Cisco ISE instance. Successful exploitation results in a denial-of-service (DoS) condition, as the repeated triggering of the logic error forces an unexpected restart of the ISE service, potentially disrupting network authentication and authorization functions.
For mitigation details, refer to the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-radsupress-dos-8YF3JThh.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-37893
Vulnerability Data
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic…
more
error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation directly exercises security-relevant comparisons to discover incorrect logic.
A reference monitor must be small and correct, structurally limiting the chance of flawed comparison logic in authorization decisions.
Security engineering principles require correct implementation of comparison logic used for access and authentication decisions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly require correct logic for security comparisons and thereby prevent this class of flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect incorrect comparison flaws before deployment.
Secure development lifecycle includes code review and testing that can catch incorrect comparison logic.
Application security requirements can mandate correct comparison logic for security decisions.
Secure architecture principles can require robust comparison mechanisms for access decisions.
Secure coding standards directly address avoiding incorrect comparison operators and logic.
Secure authentication mechanisms rely on correct comparison of credentials or tokens.