Cisco is liberated Updates to eliminate two deficiencies of the maximum capacity in the identity engine (ISE) and ISE a passive identity connector (ISE-PIC) that can allow an unauthorized attacker to perform arbitrary commands as a root user.
The vulnerabilities assigned to the CVE-2015-20281 and CVE-2015-20282 IDs are given a CVS mark for 10.0 each. Description of defects below –
- Cve-2025-20281 – Invalid vulnerability of the remote code that affects
- Cve-2015-20282 – Invalid vulnerability of the remote code that affects
Cisco said that the CVE-2025-20281 is the result of insufficient input check that the user can use by sending an API request to receive increased privileges and launching commands.
Unlike this, the CVE-2025-20282 stems from the lack of a file check, which otherwise prevent the location of the downloaded files into the privileged directory.
“Successful feat can allow the attacker to store malicious files in the affected system and then execute an arbitrary code or get root privileges in the system,” Cisco said.
The network equipment provider said there were no solutions that solve problems. Disadvantages were considered in the versions below –
- Cve-2025-20281 .
- Cve-2015-20282 -Cisco ise or ISE-PIC 3.4 Patch 2 (ISE-APPLY-CSCWO99449_3.4.608_PATCH1-sPA.TAR.GZ
The company counted Bobby Goold with Trend Micro Zero Day Initiative and Kentaro Kawane from GMO cybersecurity for Cve-2025-20281. Kawane which previously reported Cve-2025-20286 (CVSS assessment: 9.9), also recognized for the Cve-2025-20282 report.
Although there is no evidence that vulnerabilities have been used in the wild, it is important that users move quickly to apply fixes to protect against potential threats.
