# CVE-2025-20281

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

- Page: https://www.vulneraibility.com/cve/CVE-2025-20281
- CVSS: 10.0
- Known exploited: yes, in CISA KEV since 2025-07-28; CISA due date 2025-08-18
- EPSS: 97.60%
- Unvetted proof-of-concept code on GitHub: 3 GitHub proofs of concept · 1 Nuclei template (first 2025-06-27)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-07-26)
- Weakness: CWE-74
- Published: 2025-06-25

## Affected versions

- Cisco Cisco Identity Services Engine Software: affected 3.3.0; 3.3 Patch 2; 3.3 Patch 1; 3.3 Patch 3; 3.4.0; 3.3 Patch 4; 3.4 Patch 1; 3.3 Patch 5; 3.3 Patch 6

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6
- [exploit] https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20281

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.