Vulnerability Analysis
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
CVE-2025-20281
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
CISA KEV
Nuclei Template
CVSS Base Score
10.0
CRITICAL
Exploitability:3.9
Impact Score:6.1
Temporal Score:-
EPSS:96.73%
Threat Intelligence Signals
CISA KEV
YES
KEV Date Added
2025-07-28
Ransomware Use
Unknown
KEV Due Date
2025-08-18
VulnCheck In-the-Wild
No
Nuclei Template
YES
EPSS Score
96.732%
EPSS Percentile
99.9th pct
GHSA ID
GitHub Severity
CRITICAL
SSVC Exploitation
—
SSVC Automatable
—
Vulnerability Class
—
Identity & Timeline
| Status | - |
| Assigning Authority | - |
| CVSS Version / Source | - |
| Reserved | - |
| Published | - |
| Patch Date (date_public) | - |
| Exploit DB Date | - |
| First GitHub PoC Date | - |
| Last Updated | - |
| Time to Patch (Days to fix) | - |
| Exploit Release Gap | - |
| PoC Release Gap | - |
| Exploit DB References | None identified |
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| No affected products specified. | ||
Social Buzz