Cisco Patches Critical ISE Vulnerabilities Enabling Root CmdExec and PrivEsc

Feb 06, 2025Ravie LakshmananUnited States

Cisco has released updates to address two critical security flaws Identity Services Engine (ISE) that could allow remote attackers to execute arbitrary commands and elevate privileges on susceptible devices.

The vulnerabilities are listed below –

• CVE-2025-20124 (CVSS score: 9.9) – An insecure Java deserialization vulnerability in an API of Cisco ISE that could permit an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device.
• CVE-2025-20125 (CVSS score: 9.1) – An authorization bypass vulnerability in an API of Cisco ISE could could permit an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node

An attacker could weaponize either of the flaws by sending a crafted serialized Java object or an HTTP request to an unspecified API endpoint, leading to privilege escalation and code execution.

Cisco said the two vulnerabilities are not dependent on one another and that there are no workarounds to mitigate them. They have been addressed in the below versions –

• Cisco ISE software release 3.0 (Migrate to a fixed release)
• Cisco ISE software release 3.1 (Fixed in 3.1P10)
• Cisco ISE software release 3.2 (Fixed in 3.2P7)
• Cisco ISE software release 3.3 (Fixed in 3.3P4)
• Cisco ISE software release 3.4 (Not vulnerable)

Deloitte security researchers Dan Marin and Sebastian Radulea have been credited with discovering and repairing the vulnerabilities.

While the networking equipment major said it’s not aware of any malicious exploitation of the flaws, users are advised to keep their systems up-to-date for optimal protection.

Upgrade your audio game with the Logitech for Creators Blue Yeti USB Microphone. With over 33,730 ratings and an impressive 4.6 out of 5 stars, it’s no wonder this is an Amazon’s Choice product. Recently, 5K+ units were purchased in the past month.

Available in five stunning colors: Teal, Silver, Pink Dawn, Midnight Blue, and Blackout, this microphone is perfect for creators looking to produce exceptional audio. Priced at only $84.99, it’s a deal you can’t afford to miss.

Elevate your recordings with clear broadcast-quality sound and explore your creativity with enhanced effects, advanced modulation, and HD audio samples. Order now for just $84.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!