CVE-2025-20130 Cisco Identity Services Engine Access Control Bypass Vulnerability

Medium 4.9 Published 4 Jun 2025 Updated 23 Jun 2025

An authenticated admin can upload arbitrary files to Cisco ISE via API, potentially leading to code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20130?

CVE-2025-20130 is a medium-severity vulnerability in Cisco Identity Services Engine, published on 4 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy function. An attacker could exploit this vulnerability by sending a crafted file upload request to a specific API endpoint. A successful exploit could allow the attacker to upload arbitrary files to an affected system.

Weakness: CWE-434, CWE-284

Which versions are affected by CVE-2025-20130?

It affects 2 products.

Products include Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector.

How do I fix CVE-2025-20130?

No fix has been published for CVE-2025-20130 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-20130 being exploited?

There is no known exploitation of CVE-2025-20130 in the wild and no public exploit code.

All Cisco Identity Services Engine vulnerabilities

Sources

Also known as GHSA-px43-75mc-j6hq.