Cisco ISE Unauthenticated API Command Injection
- Product
- Cisco Identity Services Engine (ISE / ISE-PIC)
- CVE
- CVE-2025-20281
- Disclosed
- 2025-06-25
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Cisco ISE and ISE-PIC 3.3 and 3.4.
- Fixed
- ISE 3.3 Patch 7, 3.4 Patch 2.
Summary
An exposed API in Cisco ISE accepted unauthenticated requests and passed user input to the OS, giving attackers root. It was reported through ZDI and added to KEV after in-the-wild exploitation in July 2025.
Root cause
Insufficient validation of user-supplied input in a specific ISE API allowed injection into an operation executed by the system. Because the API required no authentication and runs as root, a single crafted request gives root code execution.
Impact
Unauthenticated root access to the network access control system.
Detection
Version-check ISE and review API logs for unexpected requests; Cisco advisory lists affected builds.
Mitigation
Apply ISE 3.3 Patch 7 or 3.4 Patch 2; no workarounds exist.