Intel

CVE-2025-20337

Security Advisory 2025-025 — Critical Vulnerabilities in Cisco ISE

criticalKEV: actively exploitedPoCEPSS 67%

Description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Source: CERTEU_ADVISORYCISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2025-20337 carries a CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — the maximum possible — and sits at the 99.2nd EPSS percentile, indicating an exceptionally high near-term exploitation probability. Cisco ISE is the central NAC and AAA system in a large proportion of NIS2-regulated and critical-infrastructure environments; full root compromise allows an attacker to subvert network access control entirely, extract RADIUS shared secrets, and pivot laterally into every connected network segment. Organisations that expose ISE API ports — even inadvertently — to the internet or to flat internal networks face immediate, critical risk and should treat patching and network isolation as a P1 action. The CISA KEV addition on 2025-07-28 confirms active exploitation in the wild; even without a known ransomware campaign flag, the potential for total loss of network access control makes this a maximum-priority remediation item.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Cisco has released security updates for ISE and ISE-PIC. Consult the Cisco PSIRT advisory for CVE-2025-20337 (cisco.com/go/psirt) to identify the correct fixed release for your version branch — multiple ISE release trains are affected.
  • Block external access to ISE API ports now: If the ISE administration interface (typically TCP 443, 9060, or 9443) is reachable from the internet or from untrusted network segments, update firewall ACLs immediately to restrict access to dedicated management VLANs and authorised jump hosts only.
  • Hunt for indicators of compromise on all ISE nodes: Check for unexpected root-level processes, new local accounts, modified cron jobs, and anomalous outbound connections on every ISE and ISE-PIC node before concluding the environment is clean.
  • Isolate ISE API access until patched: Apply a deny-by-default posture — no direct API access from production or user VLANs. Only authorised management hosts should reach the API surface.
  • Activate your incident response process: Because this vulnerability allows unauthenticated remote code execution as root, any confirmed or suspected exploitation must trigger immediate IR escalation and node isolation.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place ISE management interfaces exclusively on an out-of-band management network. Enforce upstream firewall ACLs permitting only authorised admin workstations and jump hosts to reach TCP 443, 9060, and 9443.
  • WAF/IPS rule: Filter inbound HTTP requests to ISE API endpoints for command-injection patterns (shell metacharacters, unusual JSON field content). Draft a Snort/Suricata signature targeting the affected API path once Cisco publishes PoC-level detail in the advisory.
  • API gateway interposition: Where ISE APIs must be reachable by external systems, place an API gateway with rate-limiting, strict input validation, and mutual TLS authentication in front of the ISE nodes.
  • Least-privilege for ISE service accounts: Verify that ISE service accounts in Active Directory and RADIUS backends hold only the minimum required permissions. A compromised ISE node must not become a pivot point via over-privileged service accounts.
  • Disable unused API endpoints: If specific ISE API endpoints are not operationally required, disable them per Cisco hardening guidance as a temporary compensating control until the patch is deployed.
  • Centralise and tune logging: Forward ISE syslog to your SIEM and lower alert thresholds for unusual API call patterns — high request frequency or unknown source IPs targeting /api/ paths.

Runbook · Step 3

Detection rules

  • Network telemetry (Zeek/Suricata): Alert on unexpected POST or PUT requests to ISE API paths from source IPs outside the authorised management range, especially where the server returns HTTP 200. 
    alert http any any -> $ISE_HOSTS [443,9060,9443] (msg:"CVE-2025-20337 ISE API suspicious request"; http.method; content:"POST"; http.uri; content:"/api/"; sid:2025203370; rev:1;)
  • Linux auditd on ISE nodes: Detect new processes spawned with EUID=0 by ISE application processes. Rule: -a always,exit -F arch=b64 -S execve -F euid=0 -k ise_root_exec. Review results for processes not part of the normal ISE runtime.
  • Sysmon / EDR process ancestry: Flag unusual child processes under ISE service processes — e.g. java spawning bash, sh, curl, wget, or nc. Sigma shape: 
    detection:
  selection:
    ParentImage|contains: 'java'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/curl'
      - '/wget'
  condition: selection
  • ISE system logs: Monitor for new local user accounts, writes to /etc/passwd or /etc/sudoers, and new cron entries via auditd: -w /etc/passwd -p wa -k passwd_change.
  • SIEM correlation: Treat a burst of API requests from a single external IP as an exploitation indicator. SPL snippet: index=network dest_port IN (443,9060,9443) uri_path="/api/*" | stats count by src_ip | where count > 10.

Metrics

Severity
critical
Priority score
220.66
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
10.0
Source: nvd-v3
CVSS v3
10.0
CVSS v4
—
EPSS percentile
99.3 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
67.0 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2025-07-18 00:00 UTC
CWE
CWE-74

Weakness classes (CWE)

  • CWE-74Class

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

    cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • cisco

    identity_services_engine

  • cisco

    identity_services_engine_passive_identity_connector

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

IDCVE-2025-20337