# CVE-2025-20281: Cisco Identity Services Engine Software - RCE

> Live exploitation tracking for CVE-2025-20281 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-20281

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Cisco Identity Services Engine Software
- **Weaknesses:** CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'))
- **Tags:** firewall, enterprise_software

## Description

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

## CrowdSec analysis

[CVE-2025-20281](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-20281) is a critical vulnerability in Cisco Identity Services Engine (ISE) and ISE-PIC that allows unauthenticated, remote attackers to execute arbitrary code as root on the underlying operating system. By exploiting insufficient input validation in a specific API, attackers can send crafted requests to gain full control over affected devices without needing credentials. This flaw poses a severe risk, enabling complete system compromise and potentially facilitating further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 13th of August 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-20281 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-20281 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the Cisco ISE ERS API by sending unauthenticated POST requests to URLs containing `/ers/sdk`, injecting arbitrary OS commands into the `name` field of the JSON payload to achieve remote code execution as root.

## Timeline

- 2025-06-25: CVE Published. CVE-2025-20281 is published to NVD.
- 2025-07-28: CISA KEV. CVE-2025-20281 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-08-13: Rule Released. CrowdSec releases a rule to detect CVE-2025-20281 exploitation attempts against the CrowdSec Network.
- 2025-08-18: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-11-05: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-20281 for the first time.

## References

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6
- https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability
- https://github.com/rix4uni/cvemapping/blob/main/2025/CVE-2025-20281/PoC.py

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-20281) follows observed exploitation activity for CVE-2025-20281. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.