InfoSecBulletin Cybersecurity for mankind
Cisco has updated its Identity Services Engine (ISE) to fix two critical security flaws that could let remote attackers execute arbitrary commands and gain elevated privileges on affected devices.
The vulnerabilities are listed below:
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
Hacker exploited Samsung MagicINFO 9 Server RCE flaw
CISA adds Langflow flaw to its KEV catalog
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers
UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition
CVE-2025-20124 (CVSS score: 9.9): A vulnerability in a Cisco ISE API that allows an authenticated attacker to run commands as the root user on a device.
CVE-2025-20125 (CVSS score: 9.1) – An authentication issue in Cisco ISE’s API could allow a remote attacker with read-only access to retrieve sensitive data, modify settings, and restart the system.
An attacker could exploit these flaws by sending a specially crafted Java object or an HTTP request to a specific API endpoint, resulting in privilege escalation and code execution.
Cisco stated that the two vulnerabilities are independent and have no available workarounds. They have been resolved in the following versions:
Cisco ISE software release 3.0 (Migrate to a fixed release)
Cisco ISE software release 3.1 (Fixed in 3.1P10)
Cisco ISE software release 3.2 (Fixed in 3.2P7)
Cisco ISE software release 3.3 (Fixed in 3.3P4)
Cisco ISE software release 3.4 (Not vulnerable)
Deloitte security researchers Dan Marin and Sebastian Radulea discovered and reported the vulnerabilities. The networking equipment company is not aware of any malicious use of the flaws but advises users to keep their systems updated for better protection.
Sophisticated malware attack on Indian Banks; Exposes 50,000 users
