PT-2025-23828 · Cisco · Cisco Identity Services Engine

Kentaro Kawane · Published 2025-06-04 · Updated 2026-05-26 · CVE-2025-20286

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (ISE) versions 3.1 through 3.4

Description A flaw in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services. This issue occurs because credentials are improperly generated during deployment on cloud platforms, causing different deployments to share the same static credentials if the software release and cloud platform are identical. An attacker could extract these credentials from one cloud-deployed instance and use them to access other instances via unsecured ports. This issue specifically affects environments where the Primary Administration node is deployed in the cloud; on-premises Primary Administration nodes are not affected.

Recommendations Update Cisco Identity Services Engine (ISE) versions 3.1 through 3.4 to a patched version.

Fix

DoS

Weakness Enumeration

CWE-259

Related Identifiers

BDU:2025-06465

CVE-2025-20286

Affected Products

Cisco Identity Services Engine

References · 64

• https://bdu.fstec.ru/vul/2025-06465 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20286 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-aws-static-cred-FPMjUcm7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20286 · Security Note
• https://twitter.com/Rajaaaaa07_/status/1930747195797725378 · Twitter Post
• https://twitter.com/crunchatlas/status/1932803374061363388 · Twitter Post
• https://twitter.com/threatlight/status/1930508687111594203 · Twitter Post
• https://twitter.com/cyashadotcom/status/1930650649256919238 · Twitter Post
• https://twitter.com/ohhara_shiojiri/status/1930539068162453829 · Twitter Post
• https://reddit.com/r/Cisco/comments/1l3z5es/99_cvss_on_cisco_ise · Reddit Post
• https://twitter.com/fernandokarl/status/1930512829884301711 · Twitter Post
• https://twitter.com/TechJuicePk/status/1937406299483869557 · Twitter Post
• https://twitter.com/Shift6Security/status/1932079612227707283 · Twitter Post
• https://t.me/purp_sec/733 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930354320685367806 · Twitter Post