Critical Cisco ISE Vulnerabilities Allow Remote Execution of Arbitrary Commands

In today’s world, cybersecurity threats pose a serious risk to corporate networks. Many large companies and organizations rely on Cisco Identity Services Engine (ISE) software to protect their networks. However, Cisco recently disclosed two critical vulnerabilities, CVE-2025-20124 and CVE-2025-20125, which could allow authenticated attackers with read-only administrator credentials to execute arbitrary commands, escalate privileges, and modify system configurations remotely.

These vulnerabilities have received very high CVSS (Common Vulnerability Scoring System) scores:
🔴 CVE-2025-20124 – 9.9 CVSS (critical)
🟠 CVE-2025-20125 – 9.1 CVSS (high)

Cisco strongly recommends updating the affected software to mitigate these security risks, as there are no available workarounds.

This vulnerability arises from the insecure deserialization of user-supplied Java byte streams in the Cisco ISE API. An attacker with read-only administrator credentials can exploit this flaw to execute malicious commands.

🔴 Severity Level: 9.9 CVSS (critical)
🔴 Potential Impact: Root access and remote execution of arbitrary commands
🔴 Attack Methodology:

  1. The attacker creates a malicious Java object.
  2. This object is sent to the Cisco ISE API.
  3. If successfully exploited, the attacker gains root privileges on the system.
  4. This access allows them to fully take over or damage the affected system.

This vulnerability results from insufficient authorization checks in the Cisco ISE API, enabling an attacker to bypass authentication and gain unauthorized access to system configurations.

🟠 Severity Level: 9.1 CVSS (high)
🟠 Potential Impact: Modification of system settings, access to sensitive data, and server reboot
🟠 Attack Methodology:

  1. The attacker sends a specially crafted HTTP request to the vulnerable API.
  2. Due to the lack of proper authorization validation, the system fails to block the request.
  3. This allows the attacker to access confidential information, modify system configurations, or restart the server.

These vulnerabilities impact Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration. The following software versions are vulnerable:

❌ Cisco ISE 3.0
❌ Cisco ISE 3.1 (fixed in 3.1P10)
❌ Cisco ISE 3.2 (fixed in 3.2P7)
❌ Cisco ISE 3.3 (fixed in 3.3P4)

✅ Cisco ISE 3.4 is confirmed to be safe from these vulnerabilities.

Cisco has released free software updates to address these vulnerabilities. To secure your system, it is crucial to update immediately to the following versions:

✔ Cisco ISE 3.1 – Upgrade to 3.1P10 or later
✔ Cisco ISE 3.2 – Upgrade to 3.2P7 or later
✔ Cisco ISE 3.3 – Upgrade to 3.3P4 or later

🔴 Important! Since no alternative mitigation measures exist, these updates must be applied as soon as possible!

These critical Cisco ISE vulnerabilities pose a severe threat to organizations and enterprises using this software. If exploited, attackers could gain remote access, steal confidential data, or completely compromise network security.

🔹 Recommended Security Measures:
✅ Immediately update Cisco ISE to the latest patched versions.
✅ Secure administrator accounts by restricting access to trusted users only.
✅ Enable monitoring systems and regularly review security logs.
✅ Strengthen security policies and use SIEM systems to detect suspicious activities.

📌 Final Thought: By keeping software up to date and implementing strong security measures, Cisco ISE users can protect their infrastructure from potential cyber threats and avoid devastating consequences.

Skip to content