Skip to content
fr Sign in
10.0 Critical

CVE-2025-20282 A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…

Description

A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.

Affected products and versions

Product Affected versions Fixed in
Cisco Identity Services Engine Software 3.4.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco Identity Services Engine Software

The 199 CVEs of Cisco Identity Services Engine Software →
CVE-2026-20241 Cisco Identity Services Engine Authorization Bypass Vulnerability 5.3 Medium CVE-2026-76426 A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to… 4.9 Medium CVE-2026-76431 A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC… 4.9 Medium CVE-2026-76427 A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to… 4.9 Medium
Track this CVE