CVE

CVE-2025-20282

10.0

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

cisco identity services engine software

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC https://nvd.nist.gov/vuln/detail/CVE-2025-20282 Remediation: Update to the latest Cisco ISE and Cisco ISE-PIC versions with security patches.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: cisco identity services engine software

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →