InfoSecBulletin Cybersecurity for mankind
Cisco has updated its Identity Services Engine (ISE) to fix two critical security flaws that could let remote attackers execute arbitrary commands and gain elevated privileges on affected devices.
The vulnerabilities are listed below:
Intel PC, laptop and server processors affected for 6 years: Report
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
CVE-2025-20124 (CVSS score: 9.9): A vulnerability in a Cisco ISE API that allows an authenticated attacker to run commands as the root user on a device.
CVE-2025-20125 (CVSS score: 9.1) – An authentication issue in Cisco ISE’s API could allow a remote attacker with read-only access to retrieve sensitive data, modify settings, and restart the system.
An attacker could exploit these flaws by sending a specially crafted Java object or an HTTP request to a specific API endpoint, resulting in privilege escalation and code execution.
Cisco stated that the two vulnerabilities are independent and have no available workarounds. They have been resolved in the following versions:
Cisco ISE software release 3.0 (Migrate to a fixed release)
Cisco ISE software release 3.1 (Fixed in 3.1P10)
Cisco ISE software release 3.2 (Fixed in 3.2P7)
Cisco ISE software release 3.3 (Fixed in 3.3P4)
Cisco ISE software release 3.4 (Not vulnerable)
Deloitte security researchers Dan Marin and Sebastian Radulea discovered and reported the vulnerabilities. The networking equipment company is not aware of any malicious use of the flaws but advises users to keep their systems updated for better protection.
Sophisticated malware attack on Indian Banks; Exposes 50,000 users
