PT-2025-29856 · Cisco · Cisco Ise-Pic+1

Kentaro Kawane · Published 2025-07-16 · Updated 2025-07-22 · CVE-2025-20285

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco ISE (affected versions not specified) Cisco ISE-PIC (affected versions not specified)

Description A flaw exists in the IP Access Restriction feature that may allow an authenticated, remote attacker to bypass configured IP access restrictions and log in to the device from a disallowed IP address. This is due to improper enforcement of access controls when using the IP Access Restriction feature. An attacker could exploit this by logging in to the API from an unauthorized source IP address, potentially gaining access to the device despite IP restrictions. The attacker must have valid administrative credentials to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-302

Related Identifiers

BDU:2025-08724

CVE-2025-20285

ZDI-25-605

Affected Products

Cisco Ise

Cisco Ise-Pic

References · 9

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08724 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-20285 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-605 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20285 · Vendor Advisory
• https://t.me/cveNotify/129820 · Telegram Post
• https://t.me/cvenotify/129820 · Telegram Post
• https://t.me/cvetracker/27990 · Telegram Post
• https://twitter.com/CVEnew/status/1945562939013947886 · Twitter Post