InfoSecBulletin Cybersecurity for mankind
A critical vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE-PIC, identified as CVE-2025-20337, has a CVSS score of 10, indicating its high severity.
According to Cisco’s advisory, this vulnerability arises from “insufficient validation of user-supplied input” in a specific API. This means that an unauthenticated, remote attacker can execute arbitrary code on the underlying operating system with root privileges—without needing any credentials.
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
This flaw “could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root,” Cisco warns.
The vulnerability affects
Cisco ISE 3.3 (Fixed in Patch 7)
Cisco ISE 3.4 (Fixed in Patch 2)
Cisco ISE 3.2 and earlier versions are unaffected by this vulnerability, providing some relief to organizations with older systems. However, those using newer versions must patch immediately to prevent serious issues.
The vulnerability lets attackers take full control of an affected system. By sending a harmful API request, they can directly insert commands into the operating system and gain root access, ignoring all security measures.
“An attacker could exploit these vulnerabilities by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device,” the advisory explains.
This exploit could be used to penetrate internal networks, install malware, steal credentials, or disable access controls.
Cisco’s Product Security Incident Response Team (PSIRT) has released patches for supported versions. There are no current signs of exploitation, but system administrators should address this serious vulnerability right away.
