CVE-2025-20343: Cisco ISE RADIUS DoS Vulnerability

CVE-2025-20343 Overview

A vulnerability in the RADIUS setting "Reject RADIUS requests from clients with repeated failures" on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.

Critical Impact

Unauthenticated remote attackers can cause Cisco ISE to restart, disrupting network access control and authentication services across the enterprise.

Affected Products

• Cisco Identity Services Engine 3.4.0
• Cisco Identity Services Engine 3.4.0 Patch 1
• Cisco Identity Services Engine 3.4.0 Patch 2
• Cisco Identity Services Engine 3.4.0 Patch 3

Discovery Timeline

• 2025-11-05 - CVE-2025-20343 published to NVD
• 2025-11-19 - Last updated in NVD database

Technical Details for CVE-2025-20343

Vulnerability Analysis

This vulnerability stems from improper handling of RADIUS authentication requests when the "Reject RADIUS requests from clients with repeated failures" feature is enabled. The logic error occurs during the processing of RADIUS access requests for MAC addresses that have already been flagged as rejected endpoints. When an attacker sends a specifically crafted sequence of RADIUS access request messages targeting these already-rejected MAC addresses, the ISE application encounters an unhandled condition that triggers an unexpected restart of the service.

The vulnerability is classified under CWE-697 (Incorrect Comparison), indicating that the underlying issue involves faulty comparison logic in how the system evaluates the state of rejected endpoints against incoming RADIUS requests. This can be exploited without requiring authentication, making it particularly dangerous in environments where Cisco ISE is exposed to untrusted network segments.

Root Cause

The root cause is a logic error (CWE-697: Incorrect Comparison) in the RADIUS request handling mechanism. When processing access requests for MAC addresses that are in the rejected endpoint state, the comparison logic fails to properly handle certain sequences of crafted requests. This incorrect comparison leads to an application state that causes the ISE service to crash and restart.

Attack Vector

The attack is conducted over the network without requiring authentication or user interaction. An attacker with network access to the Cisco ISE RADIUS service can send a specific sequence of crafted RADIUS access request messages. The attack targets MAC addresses that are already marked as rejected endpoints in the ISE database. By exploiting the logic error in how these requests are processed, the attacker can trigger a denial of service condition that causes Cisco ISE to restart, disrupting authentication services for the entire network.

The attack sequence involves:

1. Identifying or guessing MAC addresses that are in the rejected endpoint state
2. Crafting multiple RADIUS access request messages targeting these MAC addresses
3. Sending the messages in a specific sequence that triggers the logic error
4. The ISE service crashes and restarts, causing a temporary outage of authentication services

Detection Methods for CVE-2025-20343

Indicators of Compromise

• Unexpected Cisco ISE service restarts or crashes in system logs
• Unusual volume of RADIUS access request messages from external sources
• Multiple RADIUS requests targeting the same MAC addresses in rapid succession
• ISE application crash dumps or core files indicating abnormal termination

Detection Strategies

• Monitor Cisco ISE system logs for unexpected service restarts or application crashes
• Implement RADIUS traffic analysis to detect unusual patterns of access request messages
• Configure alerts for RADIUS requests targeting MAC addresses in the rejected endpoint list
• Deploy network-based intrusion detection rules to identify crafted RADIUS packet sequences

Monitoring Recommendations

• Enable verbose logging for RADIUS authentication events on Cisco ISE
• Monitor ISE health dashboard for service availability and restart events
• Implement SIEM correlation rules to detect patterns of RADIUS abuse followed by service disruption
• Track and alert on MAC addresses that repeatedly appear in rejected endpoint lists with subsequent access attempts

How to Mitigate CVE-2025-20343

Immediate Actions Required

• Review the Cisco Security Advisory for the latest patch information
• Assess whether the "Reject RADIUS requests from clients with repeated failures" feature is enabled in your environment
• Implement network segmentation to limit exposure of Cisco ISE RADIUS services to trusted sources
• Apply vendor patches as soon as they become available

Patch Information

Cisco has released a security advisory addressing this vulnerability. Administrators should consult the official Cisco Security Advisory for detailed patch information and upgrade instructions. The advisory includes specific guidance on which ISE versions contain the fix and the recommended upgrade path for affected deployments.

Workarounds

• Consider temporarily disabling the "Reject RADIUS requests from clients with repeated failures" feature if operationally feasible
• Implement network access control lists to restrict RADIUS traffic to trusted network devices only
• Deploy rate limiting on RADIUS authentication requests to mitigate potential abuse
• Configure firewall rules to block RADIUS traffic from untrusted network segments

# Example: Restrict RADIUS traffic at network perimeter (adjust IPs as needed)
# Allow RADIUS from trusted network access devices only
iptables -A INPUT -p udp --dport 1812 -s <trusted_network>/24 -j ACCEPT
iptables -A INPUT -p udp --dport 1813 -s <trusted_network>/24 -j ACCEPT
iptables -A INPUT -p udp --dport 1812 -j DROP
iptables -A INPUT -p udp --dport 1813 -j DROP