CVE-2025-20124

This repository contains a Python-based exploit for CVE-2025-20124 (Java deserialization RCE) and CVE-2025-20125 (authorization bypass) in Cisco ISE. The exploit includes functionality to execute commands via deserialization and bypass authentication for configuration changes.

This repository contains a Python-based exploit for CVE-2025-20124, targeting a Java deserialization vulnerability in Cisco ISE 3.0. The exploit sends a crafted serialized object to an internal endpoint, allowing remote command execution on the target system.

This exploit targets a Java deserialization vulnerability in Cisco ISE 3.0, allowing remote code execution via a crafted payload sent to the API endpoint. It requires an authenticated session token and constructs a base64-encoded serialized payload to execute arbitrary commands.