InfoSecBulletin Cybersecurity for mankind
A critical vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE-PIC, identified as CVE-2025-20337, has a CVSS score of 10, indicating its high severity.
According to Cisco’s advisory, this vulnerability arises from “insufficient validation of user-supplied input” in a specific API. This means that an unauthenticated, remote attacker can execute arbitrary code on the underlying operating system with root privileges—without needing any credentials.
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 Airports
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
This flaw “could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root,” Cisco warns.
The vulnerability affects
Cisco ISE 3.3 (Fixed in Patch 7)
Cisco ISE 3.4 (Fixed in Patch 2)
Cisco ISE 3.2 and earlier versions are unaffected by this vulnerability, providing some relief to organizations with older systems. However, those using newer versions must patch immediately to prevent serious issues.
The vulnerability lets attackers take full control of an affected system. By sending a harmful API request, they can directly insert commands into the operating system and gain root access, ignoring all security measures.
“An attacker could exploit these vulnerabilities by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device,” the advisory explains.
This exploit could be used to penetrate internal networks, install malware, steal credentials, or disable access controls.
Cisco’s Product Security Incident Response Team (PSIRT) has released patches for supported versions. There are no current signs of exploitation, but system administrators should address this serious vulnerability right away.
