Cisco Identity Services Engine Software - RCE (CVE-2025-20281)

CVE-2025-20281 is a critical vulnerability in Cisco Identity Services Engine (ISE) and ISE-PIC that allows unauthenticated, remote attackers to execute arbitrary code as root on the underlying operating system. By exploiting insufficient input validation in a specific API, attackers can send crafted requests to gain full control over affected devices without needing credentials. This flaw poses a severe risk, enabling complete system compromise and potentially facilitating further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 13th of August 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-20281 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-20281 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the Cisco ISE ERS API by sending unauthenticated POST requests to URLs containing /ers/sdk, injecting arbitrary OS commands into the name field of the JSON payload to achieve remote code execution as root.