PT-2025-5705 · Cisco · Cisco Ise

Sebastian Radulea

·

Published

2025-02-05

·

Updated

2025-08-14

·

CVE-2025-20125

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Name of the Vulnerable Software and Affected Versions Cisco ISE versions (affected versions not specified)
Description A lack of authorization in a specific API and improper validation of user-supplied data could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node. The attacker could exploit this issue by sending a crafted HTTP request to a specific API on the device. A successful exploit could allow the attacker to obtain information, modify system configuration, and reload the device. This issue could be exploited by an attacker with valid read-only administrative credentials. It is estimated that over 45,000 organizations worldwide could be affected.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285CWE-862

Related Identifiers

CVE-2025-20125

Affected Products

Cisco Ise