CVE-2025-20343 Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability

High 8.6 Published 5 Nov 2025 Updated 5 Nov 2025

An unauthenticated remote attacker can cause a denial of service by sending crafted RADIUS requests to Cisco ISE when a specific suppression setting is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20343?

CVE-2025-20343 is a high-severity denial of service vulnerability in Cisco Identity Services Engine, published on 5 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.

Weakness: CWE-697

Which versions are affected by CVE-2025-20343?

It affects 1 product.

Products include Cisco Identity Services Engine.

How do I fix CVE-2025-20343?

No fix has been published for CVE-2025-20343 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-20343 being exploited?

There is no known exploitation of CVE-2025-20343 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Cisco Identity Services Engine vulnerabilities

Sources

Also known as GHSA-cfwq-p5hw-9v6p.