Cisco Systems

Cisco Systems has identified multiple remote code execution vulnerabilities in its Identity Services Engine (ISE) that are being actively exploited. These vulnerabilities allow unauthenticated remote attackers to execute arbitrary commands with root privileges on affected systems. The flaws, assigned CVE numbers CVE-2025-20281, CVE-2025-20282, and CVE-2025-20337, affect Cisco ISE and ISE Passive Identity Connector (ISE-PIC) deployments. The company has released patches and emphasized the urgency of applying them immediately.

Source: https://cybersecuritynews.com/cisco-ise-rce-vulnerability-exploited-in-wild/

TPRM report: https://scoringcyber.rankiteo.com/company/cisco

"id": "cis958072325",
"linkid": "cisco",
"type": "Vulnerability",
"date": "7/2025",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Technology',
                        'location': 'Global',
                        'name': 'Cisco Systems',
                        'size': 'Large Enterprise',
                        'type': 'Corporation'}],
 'attack_vector': 'Remote Code Execution',
 'date_detected': '2025-07-01',
 'date_publicly_disclosed': '2025-07-01',
 'description': 'Cisco Systems has issued a critical security advisory warning '
                'of multiple remote code execution vulnerabilities in its '
                'Identity Services Engine (ISE) that are being actively '
                'exploited by attackers in the wild.',
 'impact': {'systems_affected': 'Cisco ISE and ISE-PIC deployments'},
 'initial_access_broker': {'entry_point': 'Crafted API requests',
                           'high_value_targets': 'Cisco ISE and ISE-PIC '
                                                 'deployments'},
 'investigation_status': 'Ongoing monitoring for exploitation attempts',
 'lessons_learned': 'Immediate patching is crucial for mitigating critical '
                    'vulnerabilities',
 'motivation': 'Unauthorized access and control',
 'post_incident_analysis': {'corrective_actions': 'Apply patches and enhanced '
                                                  'fixed releases',
                            'root_causes': 'Insufficient validation of '
                                           'user-supplied input in specific '
                                           'APIs'},
 'recommendations': 'Verify ISE versions and apply necessary patches',
 'references': [{'date_accessed': '2025-07-01',
                 'source': 'Cisco Security Advisory'}],
 'response': {'communication_strategy': 'Public advisory and urgent calls for '
                                        'patching',
              'containment_measures': 'Immediate patching',
              'remediation_measures': 'Apply patches and enhanced fixed '
                                      'releases'},
 'title': 'Cisco ISE Critical Vulnerabilities Actively Exploited',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': ['CVE-2025-20281',
                             'CVE-2025-20282',
                             'CVE-2025-20337']}