Cisco Patches Critical ISE Vulnerabilities Allowing Root Access

2025-02-08

Need some ammo against Cisco? This article is for you!

Cisco has released patches for two critical vulnerabilities in its Identity Services Engine (ISE) that could allow remote attackers to execute arbitrary commands and elevate privileges. These flaws include an insecure Java deserialization vulnerability and an authorization bypass, which could be exploited by sending crafted requests to the API. Both vulnerabilities require patching, as there are no other workarounds, and while there is no evidence of exploitation, keeping systems updated is advised.

Key Facts

Risks:

Privilege Escalation, API Vulnerability

Keywords:

Cisco, Identity Services Engine, ISE, Vulnerabilities, CVE-2025-20124, CVE-2025-20125, Root Access, Privilege Escalation

CVE:

CVE-2025-20124; CVE-2025-20125

Affected:

Cisco Identity Services Engine

Article Body

Cisco Addresses Critical ISE Vulnerabilities

Cisco has released crucial updates to fix two significant security vulnerabilities in their Identity Services Engine (ISE), a platform used for secure network access control and policy enforcement. These vulnerabilities, if exploited, could allow remote attackers to gain elevated privileges and execute commands with root access on affected systems.

Vulnerabilities Overview

• CVE-2025-20124: This vulnerability scores a high 9.9 on the CVSS scale. It is due to insecure Java deserialization within an API of the Cisco ISE. An attacker, who is authenticated remotely, could exploit this flaw to execute arbitrary commands as the root user on the affected device.

• CVE-2025-20125: With a CVSS score of 9.1, this vulnerability involves an authorization bypass in the API. An authenticated remote attacker with valid read-only credentials could exploit this to access sensitive information, modify node configurations, and restart the node.

Exploitation Method

Attackers could leverage these vulnerabilities by sending specially crafted serialized Java objects or HTTP requests to an unspecified API endpoint. Successful exploitation could lead to unauthorized command execution and privilege escalation.

Remediation

Cisco has stated that these vulnerabilities are independent of each other and there are no available workarounds. The only solution is to apply the latest patches provided by Cisco to ensure systems remain secure. Although Cisco is not aware of any active exploitation of these vulnerabilities, it strongly recommends keeping systems updated to safeguard against potential threats.

Read More

https://thehackernews.com/2025/02/cisco-patches-critical-ise.html?m=1