CVE-2025-20284

Estado: AnalizadaAlta (7.2)—

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root.

This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, the attacker must have valid high-privileged credentials.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.2

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 17%
Percentil entre todas las CVEs puntuadas: 97
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement95 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %
Impacto secundarioT1068 Exploitation for Privilege Escalationprivilege escalation85 %

Vector CVSS con AV:N y PR:H (red con privilegios altos) → T1210. Impactos: ejecución arbitraria de comandos como root (T1059) y escalada a máxima privanza (T1068). Requiere credenciales válidas de alto nivel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Privileged Account Management Execution Prevention Disable or Remove Feature or Program Application Isolation and Sandboxing Exploit Protection

Tecnologías afectadas (2)

Cisco — Identity Services Engine Cisco — Identity Services Engine Passive Identity Connector

CWE

CWE-74

Referencias

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-20284",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-20284",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-17T03:55:50.843551Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "Cisco",
          "product": "Cisco Identity Services Engine Software",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            },
            {
              "status": "affected",
              "version": "3.4.0"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 4"
            },
            {
              "status": "affected",
              "version": "3.4 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 5"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 6"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-07-16T17:15:30.010",
  "references": [
    {
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, the attacker must have valid high-privileged credentials."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en una API específica de Cisco ISE y Cisco ISE-PIC podría permitir que un atacante remoto autenticado ejecute código arbitrario en el sistema operativo subyacente como usuario root. Esta vulnerabilidad se debe a una validación insuficiente de la entrada proporcionada por el usuario. Un atacante con credenciales válidas podría explotar esta vulnerabilidad enviando una solicitud de API manipulada. Una explotación exitosa podría permitirle ejecutar comandos como usuario root. Para explotar esta vulnerabilidad, el atacante debe tener credenciales válidas con privilegios altos."
    }
  ],
  "lastModified": "2026-06-17T08:41:20.893",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "804C2F93-8ADC-454A-90DF-59F51FEF9E0A",
              "versionEndExcluding": "3.3.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1B9C2C1-59A4-49A0-9B74-83CCB063E55D"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFD29A0B-0D75-4EAB-BCE0-79450EC75DD0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6C94CC4-CC08-4DAF-A606-FDAFC92720A9"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB069EA3-7B8C-42B5-8035-2EE5ED3F56E4"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF8B81A6-BF44-4E5F-B167-39F61DDCA026"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56E0F0EC-3E66-4866-89F5-89B331F3F517"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E3E8937-2859-4A2A-91C0-05F674EF0466"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D23905E0-E525-49B1-8E5F-4EB42D186768"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74509498-38EF-4345-9583-CEF5C26CA1D8"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7F4D769-1845-41F0-8F15-B5D8AC15DFD9",
              "versionEndExcluding": "3.3.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CA3315D-8A45-43F4-A0F0-094D325F285B"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3736136-9FD8-4B12-B119-EA15201224D9"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "654ED77E-22D3-4E76-9E6D-B1581F5982F0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0648EE9-F042-479F-9AAB-C6B5DBC46511"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83F3BA58-4F38-41C8-956F-38A2F44EECE4"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C30FA1D-91E2-48C5-B181-A88FDF668278"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "768215B1-80B7-40FF-8772-BA4C0B3913F5"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC0525FD-C4D7-4B48-BF35-1791391AB148"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68C96F6B-51EE-4D03-9598-CBFD16DA22EF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}