PT-2025-26853 · Cisco · Cisco Ise-Pic+1

Kentaro Kawane · Published 2025-06-25 · Updated 2025-11-12 · CVE-2025-20282

Positive Technologies · (AI Summary)

CVSS v3.1

10

Critical

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco ISE and Cisco ISE-PIC versions 3.4

Description A vulnerability exists in an internal API of Cisco ISE and Cisco ISE-PIC due to missing file validation checks. This allows an unauthenticated, remote attacker to upload arbitrary files to an affected device and execute them on the underlying operating system as root. The attacker could exploit this by uploading a crafted file, potentially storing malicious files and executing arbitrary code or gaining root privileges. This issue is actively exploited in real-world attacks.

Recommendations Update Cisco ISE and Cisco ISE-PIC version 3.4 to a fixed version.

Exploit

Fix

RCE

Special Elements Injection

Improper Privilege Management

Weakness Enumeration

CWE-74

CWE-269

Related Identifiers

BDU:2025-07648

CVE-2025-20282

ZDI-25-608

Affected Products

Cisco Ise

Cisco Ise-Pic

References · 80

• 🔥 https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC · Exploit
• https://zerodayinitiative.com/advisories/ZDI-25-608 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-20282 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-20282 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07648 · Security Note
• https://twitter.com/DarkWebInformer/status/1939763474852110423 · Twitter Post
• https://twitter.com/moton/status/1938384212849267034 · Twitter Post
• https://twitter.com/gossy_84/status/1938522819362492777 · Twitter Post
• https://t.me/true_secator/7172 · Telegram Post
• https://twitter.com/transilienceai/status/1938455520962068724 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1938394111603839463 · Twitter Post
• https://twitter.com/DefusedCyber/status/1955672959474979239 · Twitter Post
• https://t.me/true_secator/7258 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1m2ybvd/top_10_trending_cves_18072025 · Reddit Post