Published: 05/02/2025 Updated: 05/02/2025

Command Injection Vulnerability in Cisco ISE API Enables Root-Level Remote Code Execution

A vulnerability exists in the API of Cisco ISE that could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. The vulnerability stems from insecure deserialization of user-supplied Java byte streams by the affected software. An attacker could potentially execute this vulnerability by sending a crafted serialized Java object to an affected API. A successful attack could enable the attacker to execute arbitrary commands on the device and elevate privileges. It is important to note that to successfully exploit this vulnerability, the attacker must possess valid read-only administrative credentials. Additionally, in a single-node deployment, new devices will not be able to authenticate during the reload time.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cisco cisco identity services engine software
cisco cisco ise passive identity connector

Critical Cisco ISE bug can let attackers run commands as root

BleepingComputer • Sergiu Gatlan • 06 Feb 2025

Critical Cisco ISE bug can let attackers run commands as root By Sergiu Gatlan February 6, 2025 11:40 AM 0 Cisco has released patches to fix two critical vulnerabilities in its Identity Services Engine (ISE) security policy management platform. Enterprise administrators use Cisco ISE as an identity and access management (IAM) solution that combines authentication, authorization, and accounting into a single appliance. The two security flaws (CVE-2025-20124 and CVE-2025-20125) can be exploited by...

CVE-2025-20124

Vulnerability Summary

Vulnerability Trend

Recent Articles

References

Vulmon Search

About

Products

Connect