Critical Injection Vulnerability (CVE‑2025‑20337) in Cisco Identity Services Engine (ISE) Enables Remote Code Execution
What It Is – Cisco Identity Services Engine (ISE) and its ISE‑PIC component contain an injection flaw in a specific API. Insufficient validation of user‑supplied input allows an attacker to send a crafted request that can trigger remote code execution with root privileges.
Exploitability – The vulnerability is publicly disclosed (CVE‑2025‑20337) and assigned a CVSS v3.1 base score of 9.8 (Critical). No public exploit has been observed, but the attack vector is straightforward: a malicious API call.
Affected Products – Cisco ISE (all supported releases) and Cisco ISE‑PIC.
Why It Matters for Trust & Control Assurance
- Continuous vulnerability monitoring and rapid patching are core evidence for a mature Vulnerability Management control objective.
- Demonstrable remediation (patch applied, configuration validated) provides audit‑ready proof that the organization is actively managing risk.
- Mapping this finding to the Verisq Common Framework (VCF) shows compliance posture across multiple standards (e.g., NIST CSF 2.0, ISO 27001) with a single control evidence set.
Recommended Actions
- Apply Cisco’s security advisory patch immediately; verify the installed version against the advisory.
- Update asset inventories and configuration baselines to reflect the patched ISE instances.
- Run an authenticated scan of all ISE devices to confirm the vulnerability is closed.
- Map the remediation to the “Vulnerability Management – timely identification and remediation” control in your framework and capture the evidence in the Trust Center.
Source: CISA KEV – CVE‑2025‑20337