CVE-2025-20124
published 2025-02-05CVE-2025-20124: A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. This…
PriorityP269high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EXPLOIT
EPSS
17.22%
96.7th percentile
A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device.
This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object to an affected API. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges.
Note: To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
| cisco | cisco_identity_services_engine_software | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xac\xed\x00\x05
- →Monitor for HTTP POST requests to the Cisco ISE API endpoint /api/v1/admin/deserializer, especially those containing a JSON body with an 'object' key carrying a base64-encoded Java serialized payload (magic bytes \xac\xed\x00\x05). ↗
- →Detect Java deserialization payloads in API requests: look for the Java serialization magic bytes 0xACED0005 in POST body content to Cisco ISE administrative API endpoints. ↗
- →Alert on Cisco ISE API calls using the ISESSIONID cookie from read-only administrative accounts that result in command execution or privilege escalation, as the vulnerability is exploitable by read-only admin credentials. ↗
- →Flag inbound requests to Cisco ISE with User-Agent string 'Mozilla/5.0 (compatible; ISE-Exploit)' as a known exploit tool indicator. ↗
- ·Exploitation requires valid ISE administrative credentials (including read-only). Detection based solely on network traffic may miss attacks from legitimate admin sessions; correlate with unexpected command execution or privilege changes on the ISE node. ↗
- ·In a single-node ISE deployment, successful exploitation (which may trigger a reload) will prevent new devices from authenticating during the reload window — factor this into impact assessment and detection triage. ↗
- ·There are no workarounds available for this vulnerability; detection and patching are the only mitigations per Cisco's advisory. ↗
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_cisco9.9CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Identity Services Engine Insecure Java Deserialization and Authorization Bypass Vulnerabilities
vendor_cisco·2025-02-05·CVSS 9.9
CVE-2025-20124 [CRITICAL] CWE-285 Cisco Identity Services Engine Insecure Java Deserialization and Authorization Bypass Vulnerabilities
Cisco Identity Services Engine Insecure Java Deserialization and Authorization Bypass Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands and elevate privileges on an affected device.
Note: To exploit these vulnerabilities, an attacker must have valid ISE administrative credentials. These vulnerabilities can be exploited using any valid administrative account, including read-only administrative accounts.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:https://sec.
Cisco
Cisco Identity Services Engine Insecure Java Deserialization and Authorization Bypass Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2025-20124 Cisco Identity Services Engine Insecure Java Deserialization and Authorization Bypass Vulnerabilities
CVE-2025-20124: Cisco Identity Services Engine Insecure Java Deserialization and Authorization Bypass Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands and elevate privileges on an affected device. Note: To exploit these vulnerabilities, an attacker must have valid ISE administrative credentials. These vulnerabilities can be exploited using any valid administrative account, including read-only administrative accounts. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-285, CWE-502, CWE-285, CWE-502
Bug IDs: CSCwk14901, CSCwk14916, CSCwk14916, CSCwk14901
GHSA
GHSA-4ch8-9r52-j78v: A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected dev
ghsa_unreviewed·2025-02-05
CVE-2025-20124 [CRITICAL] CWE-502 GHSA-4ch8-9r52-j78v: A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected dev
A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device.
This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object to an affected API. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges.
Note: To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.
No detection rules found.
Checkpoint
10th February – Threat Intelligence Report
blogs_checkpoint·2025-02-10
CVE-2025-0994 10th February – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 10th February – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 10th February, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Grubhub, the US-based online food ordering and delivery platform, suffered a data breach due to unauthorized access through a compromised third-party service provider’s account. The incident exposed personal details of customers, drivers, and merchants, including names, email addresses, phone numbers, payment card types
Bleepingcomputer
Critical Cisco ISE bug can let attackers run commands as root
blogs_bleepingcomputer·2025-02-06·CVSS 9.9
CVE-2025-20124 [CRITICAL] Critical Cisco ISE bug can let attackers run commands as root
## Critical Cisco ISE bug can let attackers run commands as root
## Sergiu Gatlan
Cisco has released patches to fix two critical vulnerabilities in its Identity Services Engine (ISE) security policy management platform.
Enterprise administrators use Cisco ISE as an identity and access management (IAM) solution that combines authentication, authorization, and accounting into a single appliance.
The two security flaws (CVE-2025-20124 and CVE-2025-20125) can be exploited by authenticated remote attackers with read-only admin privileges to execute arbitrary commands as root and bypass authorization on unpatched devices.
These vulnerabilities impact Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC) appliances, regardless of device configuration.
"This vulnerability is due to in
2025-02-05
Published