CVE-2025-20337

cisco identity services engine, cisco identity services engine passive identity connector

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2025-20337

Katalog CVE

CVSS 10.0 · Critical KEV · sudah dieksploitasi EPSS 68,0%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada cisco identity services engine, cisco identity services engine passive identity connector. Skor CVSS 3.1 10.0 (Critical) menurut cisco.com. Masuk katalog KEV CISA pada 28 Juli 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

Rincian

Terbit di NVD
16 Juli 2025
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
10.0 (Critical), sumber cisco.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari)
68,0% peluang dieksploitasi; lebih tinggi dari 99,3% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama
Cisco Identity Services Engine Injection Vulnerability
Masuk KEV
28 Juli 2025
Tenggat CISA
18 Agustus 2025 (untuk instansi federal AS)
Ransomware
Belum tercatat
Tindakan wajib
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

VendorProdukVersi terdampak
cisco identity services engine Versi 3.3.0
cisco identity services engine Versi 3.3.0 patch1
cisco identity services engine Versi 3.3.0 patch2
cisco identity services engine Versi 3.3.0 patch3
cisco identity services engine Versi 3.3.0 patch4
cisco identity services engine Versi 3.3.0 patch5
cisco identity services engine Versi 3.3.0 patch6
cisco identity services engine Versi 3.4.0
cisco identity services engine Versi 3.4.0 patch1
cisco identity services engine passive identity connector Versi 3.3.0
cisco identity services engine passive identity connector Versi 3.3.0 patch1
cisco identity services engine passive identity connector Versi 3.3.0 patch2
cisco identity services engine passive identity connector Versi 3.3.0 patch3
cisco identity services engine passive identity connector Versi 3.3.0 patch4
cisco identity services engine passive identity connector Versi 3.3.0 patch5
cisco identity services engine passive identity connector Versi 3.3.0 patch6
cisco identity services engine passive identity connector Versi 3.4.0
cisco identity services engine passive identity connector Versi 3.4.0 patch1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.