CVE-2025-20131

MEDIUM

Cisco Identity Services Engine Software < 3.1.0 p5 and < 3.2.0 - Authenticated Arbitrary File Upload via GUI

Title source: llm

Description

A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy function. An attacker could exploit this vulnerability by sending a crafted file upload using the Cisco ISE GUI. A successful exploit could allow the attacker to upload arbitrary files to an affected system.

References (1)

Core 1

Core References

Various Sources

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-qksX6C8g

Scores

CVSS v3 4.9

EPSS 0.0006

EPSS Percentile 17.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284

Status published

Products (21)

Cisco/Cisco Identity Services Engine Software 2.7.0 p8

Cisco/Cisco Identity Services Engine Software 3.1.0

Cisco/Cisco Identity Services Engine Software 3.1.0 p1

Cisco/Cisco Identity Services Engine Software 3.1.0 p2

Cisco/Cisco Identity Services Engine Software 3.1.0 p3

Cisco/Cisco Identity Services Engine Software 3.1.0 p4

Cisco/Cisco Identity Services Engine Software 3.1.0 p5

Cisco/Cisco Identity Services Engine Software 3.1.0 p6

Cisco/Cisco Identity Services Engine Software 3.1.0 p7

Cisco/Cisco Identity Services Engine Software 3.1.0 p8

... and 11 more

Published Aug 20, 2025

Tracked Since Feb 18, 2026