Cisco has released patches to fix two critical vulnerabilities in its Identity Services Engine (ISE) security policy management platform. Enterprise administrators use Cisco ISE as an identity and access management (IAM) solution that combines authentication, authorization, and accounting into a single appliance. The two security flaws (CVE-2025-20124 and CVE-2025-20125) can be exploited by authenticated remote attackers with read-only admin privileges to execute arbitrary commands as root and bypass authorization on unpatched devices. These vulnerabilities impact Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC) appliances, regardless of device configuration. "This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected software," Cisco said, describing the CVE-2025-20124 bug tagged with a 9.9/10 severity rating. "An attacker could exploit this vulnerability by sending a crafted serialized Java object to an affected API. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges." CVE-2025-20125 is caused by a lack of authorization in a specific API and improper validation of user-supplied data, which can be exploited using maliciously crafted HTTP requests to obtain information, modify a vulnerable system's configuration, and reload the device. Admins are advised to migrate or upgrade their Cisco ISE appliances to one of the fixed releases listed in the table below ...
Critical Cisco ISE bug can let attackers run commands as root
BleepingComputer
·Sergiu Gatlan
·Published Feb 6, 2025
·Updated
Affected Software
8 affected components
Cisco Identity Services Engine (ISE)
Cisco ISE Passive Identity Connector (ISE-PIC)
Cisco IOS
Cisco IOS XE
Cisco IOS XR
Cisco NX-OS
Cisco Identity Services Engine
Cisco ISE-PIC
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses critical vulnerabilities in Cisco's Identity Services Engine (ISE) that can allow attackers to execute commands as root.
2
What security implications are discussed?
The vulnerabilities could lead to unauthorized access and complete administrative control over affected systems.
3
What products or software are affected?
The affected products include Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), among others.
4
What actions has Cisco taken regarding these vulnerabilities?
Cisco has released patches to address the critical vulnerabilities found in the ISE platform.
5
Who should be concerned about this security issue?
Enterprise administrators using Cisco ISE for identity and access management should be particularly concerned about these vulnerabilities.