CVE-2025-20281
CRITICAL KEV NUCLEICisco Identity Services Engine - Unauthenticated Remote Code Execution via API Request
Title source: llmExploitation Summary
CVE-2025-20281 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added July 28, 2025. EIP tracks 3 public exploits from researchers including abrewer251, grupooruss, ill-deed. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a functional Python PoC for CVE-2025-20281, exploiting an unauthenticated RCE vulnerability in Cisco ISE's ERS API by injecting shell commands into the 'InternalUser' resource. It supports both a simple 'whoami' check and a reverse shell payload.
Description
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.
Exploits (3)
This is a functional Python PoC for CVE-2025-20281, exploiting an unauthenticated RCE vulnerability in Cisco ISE's ERS API by injecting shell commands into the 'InternalUser' resource. It supports both a simple 'whoami' check and a reverse shell payload.
This repository contains a Python script that checks for the presence of CVE-2025-20281, an unauthenticated RCE vulnerability in Cisco ISE. The script sends a crafted payload to a specific API endpoint and analyzes the response for signs of vulnerability.
This is a functional Python PoC exploit for CVE-2025-20281, targeting an unauthenticated RCE vulnerability in Cisco ISE ERS API via command injection in the 'InternalUser' name parameter. It supports arbitrary command execution, reverse shells, and basic testing.
Nuclei Templates (1)
"Set-Cookie: APPSESSIONID=" "Path=/admin"
title="identity services engine"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H