CVE-2025-20130: Cisco ISE Auth Bypass Vulnerability

CVE-2025-20130 Overview

CVE-2025-20130 is an arbitrary file upload vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The flaw stems from improper validation in the file copy function exposed by a specific API endpoint. An authenticated, remote attacker with administrative privileges can send a crafted file upload request to write arbitrary files to an affected device. Cisco published a security advisory tracking this issue, and the vulnerability maps to [CWE-284] Improper Access Control and [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Successful exploitation allows attackers with administrative API credentials to upload arbitrary files to an ISE or ISE-PIC appliance, threatening the integrity of an identity and access control system used to govern network authentication.

Affected Products

Cisco Identity Services Engine (ISE) versions 3.1, 3.2, and 3.3, including patch levels through 3.1 patch 9, 3.2 patch 6, and 3.3 patch 2
Cisco Identity Services Engine Passive Identity Connector (ISE-PIC) versions 3.1, 3.2, and 3.3, including the same patch ranges
Deployments exposing the ISE administrative API to remote networks

Discovery Timeline

2025-06-04 - CVE-2025-20130 published to the National Vulnerability Database
2025-07-22 - Last updated in NVD database

Technical Details for CVE-2025-20130

Vulnerability Analysis

The vulnerability resides in the file copy logic backing an authenticated API endpoint in Cisco ISE and ISE-PIC. The endpoint accepts file upload requests but fails to properly validate the supplied file before writing it to the system. Because the affected functionality is reachable over the network and requires only administrative credentials, an attacker who has compromised or legitimately holds an administrator account can place arbitrary content on the appliance. Cisco ISE is a policy decision point for network access, so unauthorized file writes can affect authentication workflows, downstream enforcement, and trust in identity decisions across the enterprise.

Root Cause

The root cause is improper validation in the file copy function tied to a specific API endpoint. The endpoint does not adequately constrain the file content, type, or destination supplied by the caller. This combination of insufficient input validation ([CWE-434]) and weak access control on the function ([CWE-284]) lets a privileged caller write files outside the bounds intended by the application.

Attack Vector

Exploitation requires network reachability to the ISE administrative API and a valid administrator credential. The attacker authenticates to the API and submits a crafted file upload request to the vulnerable endpoint. No user interaction is required. The vulnerability does not provide an authentication bypass, so it primarily extends the impact of compromised or misused administrator accounts and increases the blast radius of any credential theft against ISE.

No public proof-of-concept exploit code is available for CVE-2025-20130 at the time of writing. Refer to the Cisco Security Advisory for vendor technical detail.

Detection Methods for CVE-2025-20130

Indicators of Compromise

Unexpected files written to ISE or ISE-PIC appliance filesystems, particularly under directories served by the management or API processes
Administrative API calls to file copy or upload endpoints from unusual source IP addresses, service accounts, or outside maintenance windows
Configuration drift on ISE nodes that cannot be tied to a documented change request

Detection Strategies

Enable and forward Cisco ISE administrative and API audit logs to a centralized logging platform and alert on file upload or copy operations
Baseline normal administrative API usage per account and flag deviations in endpoint, source, or request size
Correlate ISE admin authentication events with subsequent file upload API calls to detect credential abuse patterns

Monitoring Recommendations

Monitor administrator account activity in ISE for logins from new geolocations, hosts, or at unusual times
Track integrity of ISE appliance filesystems using vendor-supported health and configuration checks
Alert on any direct network access to the ISE administrative interface from segments that should not be reaching it

How to Mitigate CVE-2025-20130

Immediate Actions Required

Apply the fixed Cisco ISE and ISE-PIC software releases identified in the Cisco Security Advisory
Inventory all ISE and ISE-PIC nodes and confirm running version and patch level against the advisory
Rotate ISE administrator credentials and API keys, especially where shared or long-lived
Audit recent administrative API activity for unexpected file upload or copy requests

Patch Information

Cisco has published fixed software in the advisory cisco-sa-ise-file-upload-P4M8vwXY. Upgrade affected ISE and ISE-PIC 3.1, 3.2, and 3.3 deployments to a release version that lists CVE-2025-20130 as resolved. Customers without an active service contract should contact the Cisco Technical Assistance Center to obtain fixed software, as described in the vendor advisory.

Workarounds

No vendor-documented workarounds were published; restrict administrative API exposure to dedicated management networks as a compensating control
Enforce least privilege on ISE administrative roles and remove unused admin accounts
Require multi-factor authentication for all ISE administrators to reduce the risk of credential abuse against this vulnerability

bash

# Configuration example: restrict access to the ISE admin interface
# Apply on upstream firewall or ACL enforcing access to ISE management IPs
access-list ISE_ADMIN_RESTRICT permit tcp 10.10.0.0 0.0.0.255 host 192.0.2.10 eq 443
access-list ISE_ADMIN_RESTRICT deny   tcp any host 192.0.2.10 eq 443 log
access-list ISE_ADMIN_RESTRICT permit ip any any