CVE-2025-20337
CISA 기관 조치 기한: 2025-08-18
Cisco Identity Services Engine
Qualys 위협 인텔 · 심각도 5/5 · QID 317666 · Cisco
공개 익스플로잇
측면이동
권한상승
원격코드실행
CISA KEV
Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.
KEV 필수 조치: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.