CVE-2025-20337 (GCVE-0-2025-20337)
Vulnerability from cvelistv5
Published
2025-07-16 16:17
Modified
2025-07-30 01:36
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Summary
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ► | Cisco | Cisco Identity Services Engine Software |
Version: 3.3.0 Version: 3.3 Patch 2 Version: 3.3 Patch 1 Version: 3.3 Patch 3 Version: 3.4.0 Version: 3.3 Patch 4 Version: 3.4 Patch 1 Version: 3.3 Patch 5 Version: 3.3 Patch 6 |
||||||
|
|||||||||
CISA Known exploited vulnerability
Data from the Known Exploited Vulnerabilities Catalog
Date added: 2025-07-28
Due date: 2025-08-18
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Used in ransomware: Unknown
Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 ; https://nvd.nist.gov/vuln/detail/CVE-2025-20337
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-20337",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-26T03:55:52.398837Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-07-28",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-30T01:36:09.152Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"timeline": [
{
"lang": "en",
"time": "2025-07-28T00:00:00+00:00",
"value": "CVE-2025-20337 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Identity Services Engine Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "3.3.0"
},
{
"status": "affected",
"version": "3.3 Patch 2"
},
{
"status": "affected",
"version": "3.3 Patch 1"
},
{
"status": "affected",
"version": "3.3 Patch 3"
},
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.3 Patch 4"
},
{
"status": "affected",
"version": "3.4 Patch 1"
},
{
"status": "affected",
"version": "3.3 Patch 5"
},
{
"status": "affected",
"version": "3.3 Patch 6"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco ISE Passive Identity Connector",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.3.0"
},
{
"status": "affected",
"version": "3.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device."
}
],
"exploits": [
{
"lang": "en",
"value": "In July 2025, the Cisco PSIRT became aware of attempted exploitation of this vulnerability in the wild. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate these vulnerabilities."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-25T12:26:22.077Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-ise-unauth-rce-ZAd2GnJ6",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6"
}
],
"source": {
"advisory": "cisco-sa-ise-unauth-rce-ZAd2GnJ6",
"defects": [
"CSCwo99449"
],
"discovery": "EXTERNAL"
},
"title": "Cisco ISE API Unauthenticated Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2025-20337",
"datePublished": "2025-07-16T16:17:04.664Z",
"dateReserved": "2024-10-10T19:15:13.255Z",
"dateUpdated": "2025-07-30T01:36:09.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"cisa_known_exploited": {
"cveID": "CVE-2025-20337",
"cwes": "[\"CWE-74\"]",
"dateAdded": "2025-07-28",
"dueDate": "2025-08-18",
"knownRansomwareCampaignUse": "Unknown",
"notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6 ; https://nvd.nist.gov/vuln/detail/CVE-2025-20337",
"product": "Identity Services Engine",
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"shortDescription": "Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.",
"vendorProject": "Cisco",
"vulnerabilityName": "Cisco Identity Services Engine Injection Vulnerability"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-20337\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2025-07-16T17:15:30.573\",\"lastModified\":\"2025-07-29T01:00:01.253\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.\\r\\n\\r\\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en una API espec\u00edfica de Cisco ISE y Cisco ISE-PIC podr\u00eda permitir que un atacante remoto no autenticado ejecute c\u00f3digo arbitrario en el sistema operativo subyacente como root. El atacante no necesita credenciales v\u00e1lidas para explotar esta vulnerabilidad. Esta vulnerabilidad se debe a una validaci\u00f3n insuficiente de la informaci\u00f3n proporcionada por el usuario. Un atacante podr\u00eda explotar esta vulnerabilidad enviando una solicitud de API manipulada. Una explotaci\u00f3n exitosa podr\u00eda permitirle obtener privilegios de root en un dispositivo afectado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}]},\"cisaExploitAdd\":\"2025-07-28\",\"cisaActionDue\":\"2025-08-18\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Cisco Identity Services Engine Injection Vulnerability\",\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1B9C2C1-59A4-49A0-9B74-83CCB063E55D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DFD29A0B-0D75-4EAB-BCE0-79450EC75DD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6C94CC4-CC08-4DAF-A606-FDAFC92720A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB069EA3-7B8C-42B5-8035-2EE5ED3F56E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF8B81A6-BF44-4E5F-B167-39F61DDCA026\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:*\",\"matchCriteriaId\":\"56E0F0EC-3E66-4866-89F5-89B331F3F517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E3E8937-2859-4A2A-91C0-05F674EF0466\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"D23905E0-E525-49B1-8E5F-4EB42D186768\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:*\",\"matchCriteriaId\":\"74509498-38EF-4345-9583-CEF5C26CA1D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"3CA3315D-8A45-43F4-A0F0-094D325F285B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3736136-9FD8-4B12-B119-EA15201224D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch2:*:*:*:*:*:*\",\"matchCriteriaId\":\"654ED77E-22D3-4E76-9E6D-B1581F5982F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0648EE9-F042-479F-9AAB-C6B5DBC46511\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch4:*:*:*:*:*:*\",\"matchCriteriaId\":\"83F3BA58-4F38-41C8-956F-38A2F44EECE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C30FA1D-91E2-48C5-B181-A88FDF668278\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch6:*:*:*:*:*:*\",\"matchCriteriaId\":\"768215B1-80B7-40FF-8772-BA4C0B3913F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC0525FD-C4D7-4B48-BF35-1791391AB148\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch1:*:*:*:*:*:*\",\"matchCriteriaId\":\"68C96F6B-51EE-4D03-9598-CBFD16DA22EF\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20337\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-26T03:55:52.398837Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2025-07-28\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20337\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-07-28T00:00:00+00:00\", \"value\": \"CVE-2025-20337 added to CISA KEV\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-17T13:06:08.056Z\"}}], \"cna\": {\"title\": \"Cisco ISE API Unauthenticated Remote Code Execution Vulnerability\", \"source\": {\"defects\": [\"CSCwo99449\"], \"advisory\": \"cisco-sa-ise-unauth-rce-ZAd2GnJ6\", \"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Identity Services Engine Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.3.0\"}, {\"status\": \"affected\", \"version\": \"3.3 Patch 2\"}, {\"status\": \"affected\", \"version\": \"3.3 Patch 1\"}, {\"status\": \"affected\", \"version\": \"3.3 Patch 3\"}, {\"status\": \"affected\", \"version\": \"3.4.0\"}, {\"status\": \"affected\", \"version\": \"3.3 Patch 4\"}, {\"status\": \"affected\", \"version\": \"3.4 Patch 1\"}, {\"status\": \"affected\", \"version\": \"3.3 Patch 5\"}, {\"status\": \"affected\", \"version\": \"3.3 Patch 6\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Cisco\", \"product\": \"Cisco ISE Passive Identity Connector\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.2.0\"}, {\"status\": \"affected\", \"version\": \"3.1.0\"}, {\"status\": \"affected\", \"version\": \"3.3.0\"}, {\"status\": \"affected\", \"version\": \"3.4.0\"}], \"defaultStatus\": \"unknown\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"In July 2025, the Cisco PSIRT became aware of attempted exploitation of this vulnerability in the wild. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate these vulnerabilities.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6\", \"name\": \"cisco-sa-ise-unauth-rce-ZAd2GnJ6\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.\\r\\n\\r\\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-74\", \"description\": \"Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2025-07-25T12:26:22.077Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-20337\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-30T01:36:09.152Z\", \"dateReserved\": \"2024-10-10T19:15:13.255Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2025-07-16T16:17:04.664Z\", \"assignerShortName\": \"cisco\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…