CVE-2025-20337 in cisco identity services engine
LogPulse has assessed this CVE and a detection rule is being built.
What the vulnerability is
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
Affected software: cisco identity services engine, cisco identity services engine passive identity connector
Scores
- CVSS: 10.0 (critical)
- EPSS: 74.50% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2025-07-28
- Published: 2025-07-16
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Cisco ISE to 3.3 Patch 7 or 3.4 Patch 2 (CVE-2025-20281, CVE-2025-20337)
Patch or upgrade. A specific ISE API lets unauthenticated attackers run commands as root. ISE 3.3 Patch 7 and 3.4 Patch 2 fix both CVEs; the earlier CSCwo99449 hot patches do not cover CVE-2025-20337 and there is no workaround.
Applies to: Cisco ISE and ISE-PIC 3.3 before Patch 7 and 3.4 before Patch 2, regardless of configuration. 3.2 and earlier are not affected.
- Check the ISE version and patch level of every node in Administration > System > Maintenance > Patch Management (or 'show version' in the CLI).
- If a node runs 3.3 (any patch up to and including Patch 6), install 3.3 Patch 7 or later.
- If a node runs 3.4 below Patch 2, install 3.4 Patch 2 or later.
- If the hot patch ise-apply-CSCwo99449_3.3.0.430_patch4-SPA.tar.gz or ise-apply-CSCwo99449_3.4.0.608_patch1-SPA.tar.gz is installed, still upgrade to 3.3 Patch 7 or 3.4 Patch 2: the hot patches do not fix CVE-2025-20337.
- Apply the patch on the Primary Administration Node first, then on the other nodes, and confirm the new patch level on each.
- Until patched, allow the ISE admin and API interfaces only from admin networks (compensating, not a fix), and, if you run Cisco Secure Firewall IPS, make sure Snort rule 65075 is enabled in blocking mode.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.