CVE-2025-20282

10.0

CRITICAL CVSS 3.1

Cisco ISE and ISE-PIC Privilege Escalation Remote File Upload Vulnerability

Description

A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.

INFO

Published Date :

June 25, 2025, 5:15 p.m.

Last Modified :

June 26, 2025, 8:35 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Affected Products

The following products are affected by CVE-2025-20282 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Cisco	identity_services_engine
2	Cisco	identity_services_engine_passive_identity_connector

: Total Affected Vendor : 1 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]

Solution

Update affected Cisco devices to patch arbitrary file upload and execution vulnerabilities.

Apply the latest Cisco security updates for ISE and ISE-PIC.
Review system logs for unauthorized file uploads.
Implement stricter file validation on all uploads.
Restrict API access to authorized personnel only.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-20282.

URL	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-20282 is associated with the following CWEs:

CWE-269: Improper Privilege Management

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-20282 weaknesses.

CAPEC-58: Restful Privilege Elevation Restful Privilege Elevation CAPEC-122: Privilege Abuse Privilege Abuse CAPEC-233: Privilege Escalation Privilege Escalation

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-20282 vulnerability anywhere in the article.

The Register

Cisco's Secure Firewall Management Center now not-so secure, springs a CVSS 10 RCE hole

Cisco has issued a patch for a maximum-severity bug in its Secure Firewall Management Center (FMC) software that could allow an unauthenticated, remote attacker to inject arbitrary shell commands on v ...

Published Date: Aug 15, 2025 (1 week, 4 days ago)

europa.eu

Cyber Brief 25-08 - July 2025

Cyber Brief (July 2025)August 4, 2025 - Version: 1TLP:CLEARExecutive summaryWe analysed 287 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, the EU, UK, and US h ...

Published Date: Aug 04, 2025 (3 weeks, 2 days ago)

The Cyber Express

CISA Adds Cisco ISE and PaperCut Vulnerabilities to Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert, adding three high-impact vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These inclu ...

Published Date: Jul 29, 2025 (4 weeks, 1 day ago)

The Register

No login? No problem: Cisco ISE flaw gave root access before fix arrived, say researchers

Threat actors have actively exploited a newly patched vulnerability in Cisco's Identity Services Engine (ISE) software since early July, weeks before the networking giant got around to issuing a fix. ...

Published Date: Jul 24, 2025 (1 month ago)

Help Net Security

Maximum severity Cisco ISE vulnerabilities exploited by attackers

One or more vulnerabilities affecting Cisco Identity Services Engine (ISE) are being exploited in the wild, Cisco has confirmed by updating the security advisory for the flaws. About the vulnerabiliti ...

Published Date: Jul 23, 2025 (1 month ago)

security.nl

Cisco waarschuwt voor actief misbruik van kritieke ISE-kwetsbaarheden

Aanvallers maken actief misbruik van kritieke kwetsbaarheden in Cisco Identity Services Engine (ISE) en Cisco ISE Passive Identity Connector (ISE-PIC) waardoor kwetsbare servers volledig op afstand zi ...