{"id":"CVE-2025-20282","aliases":["EUVD-2025-19166","GHSA-w8p2-wjjr-hr24"],"status":"published","title":"Cisco ISE API Unauthenticated Remote Code Execution Vulnerability","description":"A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root.\r\n\r\nThis vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.38719,"percentile":0.98591,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-269"],"published":"2025-06-25T16:29:12Z","modified":"2026-06-17T08:41:20Z","exploits":[{"source":"nuclei","id":"CVE-2025-20282","title":"Cisco ISE \u003c 3.4P2 - Unauthenticated Arbitrary File Upload","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20282.yaml"},{"source":"pocgithub","id":"skadevare/CiscoISE-CVE-2025-20282-POC","title":"skadevare/CiscoISE-CVE-2025-20282-POC","date":"2025-07-01","url":"https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC"}],"products":[{"vendor":"cisco","product":"cisco identity services engine software"},{"vendor":"cisco","product":"identity_services_engine"},{"vendor":"cisco","product":"identity_services_engine_passive_identity_connector"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20282"},{"url":"https://github.com/advisories/GHSA-w8p2-wjjr-hr24"}],"sources":{"cve":[{"id":"CVE-2025-20282","title":"Cisco ISE API Unauthenticated Remote Code Execution Vulnerability","description":"A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root.\r\n\r\nThis vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.","status":"published","published":"2025-06-25T16:29:12.357Z","modified":"2026-02-26T17:50:23.927Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:32:25.5658Z"}],"euvd":[{"id":"EUVD-2025-19166","description":"A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root.\r\n\r\nThis vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.","status":"published","published":"2025-06-25T16:29:12Z","modified":"2026-02-26T17:50:23Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:19.481461Z"}],"ghsa":[{"id":"GHSA-w8p2-wjjr-hr24","title":"A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated,...","description":"A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root.\n\nThis vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.","status":"published","published":"2025-06-26T21:31:12Z","modified":"2025-06-26T21:31:13Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:02:49.894932Z"}],"nvd":[{"id":"CVE-2025-20282","description":"A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root.\r\n\r\nThis vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.","status":"published","published":"2025-06-25T17:15:37.49Z","modified":"2026-06-17T08:41:20.673Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:11:14.781314Z"}]}}