Arbitrary File Upload Vulnerability in Cisco ISE and ISE-PIC
CVE-2025-20282

10CRITICAL

Key Information:

Vendor

Cisco
Status
Cisco Identity Services Engine Software
Vendor
CVE Published:
25 June 2025

Badges

👾 Exploit Exists

What is CVE-2025-20282?

A vulnerability exists in an internal API of Cisco ISE and Cisco ISE-PIC that enables unauthenticated remote attackers to upload arbitrary files to the system. This oversight is caused by insufficient validation checks during the file upload process, allowing malicious files to be placed in privileged directories. An attacker exploiting this vulnerability can execute these files, thereby gaining root-level access to the system and potentially compromising its integrity.

Affected Version(s)

Cisco Identity Services Engine Software 3.4.0

Cisco Identity Services Engine Software 3.4 Patch 1

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-20282 : Arbitrary File Upload Vulnerability in Cisco ISE and ISE-PIC