{"id":"CVE-2025-20125","aliases":["EUVD-2025-2153","GHSA-hrpp-92f9-h887"],"status":"published","title":"Cisco Identity Services Engine Insufficient Authorization Bypass Vulnerability","description":"A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node.\r\n\r\nThis vulnerability is due to a lack of authorization in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a crafted HTTP request to a specific API on the device. A successful exploit could allow the attacker to attacker to obtain information, modify system configuration, and reload the device.\r\nNote:\u0026nbsp;To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.16384,"percentile":0.97014,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-285","CWE-862"],"published":"2025-02-05T16:12:17Z","modified":"2026-06-17T08:40:43Z","exploits":[{"source":"exploitdb","id":"EDB-52397","title":"Cisco ISE 3.0 - Authorization Bypass","type":"remote","platform":"multiple","date":"2025-08-11","url":"https://www.exploit-db.com/exploits/52397"}],"products":[{"vendor":"cisco","product":"cisco identity services engine software"},{"vendor":"cisco","product":"cisco ise passive identity connector"},{"vendor":"cisco","product":"identity_services_engine"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multivuls-FTW9AOXF","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20125"},{"url":"https://github.com/advisories/GHSA-hrpp-92f9-h887"}],"sources":{"cve":[{"id":"CVE-2025-20125","title":"Cisco Identity Services Engine Insufficient Authorization Bypass Vulnerability","description":"A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node.\r\n\r\nThis vulnerability is due to a lack of authorization in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a crafted HTTP request to a specific API on the device. A successful exploit could allow the attacker to attacker to obtain information, modify system configuration, and reload the device.\r\nNote:\u0026nbsp;To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.","status":"published","published":"2025-02-05T16:12:17.272Z","modified":"2025-02-05T17:21:58.525Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:32:25.186422Z"}],"euvd":[{"id":"EUVD-2025-2153","description":"A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node.\r\n\r\nThis vulnerability is due to a lack of authorization in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a crafted HTTP request to a specific API on the device. A successful exploit could allow the attacker to attacker to obtain information, modify system configuration, and reload the device.\r\nNote:\u0026nbsp;To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.","status":"published","published":"2025-02-05T16:12:17Z","modified":"2025-02-05T17:21:58Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:05.079502Z"}],"ghsa":[{"id":"GHSA-hrpp-92f9-h887","title":"A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid...","description":"A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node.\n\nThis vulnerability is due to a lack of authorization in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a crafted HTTP request to a specific API on the device. A successful exploit could allow the attacker to attacker to obtain information, modify system configuration, and reload the device.\nNote:\u0026nbsp;To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.","status":"published","published":"2025-02-05T18:34:44Z","modified":"2025-03-28T15:32:59Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"cwes":["CWE-285","CWE-862"],"updated_at":"2026-11-02T15:00:30.942475Z"}],"nvd":[{"id":"CVE-2025-20125","description":"A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node.\r\n\r\nThis vulnerability is due to a lack of authorization in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a crafted HTTP request to a specific API on the device. A successful exploit could allow the attacker to attacker to obtain information, modify system configuration, and reload the device.\r\nNote:\u0026nbsp;To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.","status":"published","published":"2025-02-05T17:15:22.61Z","modified":"2026-06-17T08:40:43.66Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-285","CWE-862"],"updated_at":"2026-11-02T14:10:50.916773Z"}]}}