/Vulnerability Library

Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

CVE-2025-20282
Verified

Description

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload.

Severity

Critical

CVSS Score

10

Exploit Probability

39%

Affected Product

identity_services_engine

Published Date

August 4, 2026

Template Author

0x_akoko, pdteam

CVE-2025-20282.yaml
10.0Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2025-20282
CWE ID:
cwe-434

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/https://github.com/skadevare/CiscoISE-CVE-2025-20282-POChttps://nvd.nist.gov/vuln/detail/CVE-2025-20282

Remediation Steps

Update to the latest Cisco ISE and Cisco ISE-PIC versions with security patches.