Privilege escalation in Cisco Identity Services Engine Software
CVE-2025-20282
A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An attacker could exploit this vulnerability by uploading a crafted file to the affected device. A successful exploit could allow the attacker to store malicious files on the affected system and then execute arbitrary code or obtain root privileges on the system.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.387 (98.6th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.275 · newest: 0.387 · change: +0.112
Affected products
- Cisco Identity Services Engine Software — versions 3.4.0, 3.4 Patch 1
- Cisco Identity Services Engine — versions 3.4.0
- Cisco Identity Services Engine Passive Connector — versions 3.4.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-20282?
- CVE-2025-20282 is a critical-severity vulnerability in Cisco Identity Services Engine Software, classified under Improper Privilege Management. CVSS score: 10.0/10. Published 2025-06-25.
- How severe is CVE-2025-20282?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2025-20282 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.