CVE-2025-20337

9.5 CISA KEV

Cisco · Identity Services Engine

An injection vulnerability in the Cisco Identity Services Engine API allows unauthenticated remote attackers to execute arbitrary code as root.

Executive summary

A critical remote code execution vulnerability in Cisco Identity Services Engine is currently being exploited in the wild, posing an immediate risk of full system compromise.

Vulnerability

This is an injection flaw (CWE-74) resulting from insufficient input validation in a specific API. An unauthenticated attacker can execute arbitrary code with root privileges by sending a crafted API request.

Business impact

Successful exploitation grants an attacker full root-level control over the affected Cisco ISE appliance. Given the central role of ISE in network access control, this vulnerability leads to unauthorized administrative access, potential data exfiltration, and total loss of network security integrity. The CVSS score of 9.5 reflects the critical nature of this vulnerability, which is compounded by active exploitation in real-world environments.

Remediation

Immediate Action: Apply the vendor-supplied security updates or patches as detailed in the Cisco security advisory immediately. If patching is not feasible, restrict access to the affected management interfaces to trusted networks only.

Proactive Monitoring: Review system logs for suspicious API requests or unexpected process execution originating from the web management interface. Monitor for unusual outbound traffic from the ISE appliances that may indicate post-exploitation activity.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to inspect and sanitize incoming API traffic to the Cisco ISE platform. Ensure that management interfaces are not exposed to the public internet.

Exploitation status

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub repository B1ack4sh/Blackash-CVE-2025-20337.

Analyst recommendation

The severity of CVE-2025-20337 cannot be overstated, as it provides a direct path to total system takeover without authentication. Organizations must prioritize the application of vendor-provided patches or mitigations to neutralize this threat. Given the confirmed active exploitation, failure to act leaves the network infrastructure exposed to immediate and severe risk.

Look Back #9

A look back, with hindsight

Published 2026-07-16. Reviewed with sources that didn't exist at disclosure time.

Backstory

Cisco Identity Services Engine is a Java network access control appliance, and several of its web API endpoints run as root on the underlying operating system. That design choice is why a single input-validation flaw becomes a full system compromise: a command injected through the API executes with root privileges directly, with no privilege escalation required. CVE-2025-20337 lives inside that pattern, and its history is unusually well documented because it traces back to one method.

On January 25, 2025, Kentaro Kawane of GMO Cybersecurity reported to Trend Micro's Zero Day Initiative a deserialization-of-untrusted-data flaw in the enableStrongSwanTunnel method of the DescriptionRegistrationListener class. The endpoint accepted a serialized Java object with no authentication, so an attacker could send a crafted string array and have the appliance deserialize it. While analyzing that report, ZDI researcher Bobby Gould found the same function was also reachable for command injection as root. He demonstrated a chain that passed a payload into Java's Runtime.exec, used the shell variable IFS to defeat argument tokenization, executed code as root inside a privileged strongSwan Docker container, then escaped to the host using the well-known cgroups release_agent technique.

Cisco first shipped a fix as CVE-2025-20281 on June 25, 2025, alongside a related file-upload flaw, CVE-2025-20282. That patch, and the interim hot patches issued for it, did not fully close the hole in the shared API. Cisco then assigned CVE-2025-20337 to cover the remaining exposure in the same endpoint and released it on July 16, 2025, fixed in ISE 3.3 Patch 7 and 3.4 Patch 2. ZDI recorded that Cisco initially assigned one CVE to both submissions before splitting them.

The recurrence is the point. In February 2025 Cisco had already patched CVE-2025-20124, an insecure Java deserialization flaw in an ISE API that let a crafted serialized object run commands as root. The same class of untrusted deserialization in a root context had appeared years earlier in Cisco Secure Access Control System. CVE-2025-20337 is not a novel failure so much as an incomplete fix layered on a long-standing pattern: unauthenticated, root-level Java endpoints that keep trusting attacker-controlled serialized input.

Technical analysis (revisited)

NVD classifies the bug as CWE-74 injection and holds it at the maximum CVSS v3.1 10.0 along the AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H vector, matching Cisco's own score. The attack primitive needs no credentials and no user interaction: a crafted request to a specific ISE API endpoint reaches code that runs as root, and insufficient validation turns that request into arbitrary command execution.

The original July 2025 analyst note described the endpoint as "unnamed." The hindsight detail that fills that gap comes from ZDI's post-disclosure writeup, which named the vulnerable enableStrongSwanTunnel method and walked the full chain from an unauthenticated serialized-object request through a root shell in a privileged container to a host escape. That writeup also made explicit what the advisory only implied: CVE-2025-20337 and CVE-2025-20281 are the same underlying weakness, and the first patch was incomplete.

The more consequential post-disclosure finding is about how the flaw was used. Amazon's threat intelligence team reported that its MadPot honeypot network observed exploitation of an ISE endpoint before Cisco had assigned a CVE or shipped comprehensive patches. The operator deployed a custom in-memory Java backdoor named IdentityAuditAction that used Java reflection to inject into running Tomcat threads and applied non-standard DES encryption with custom Base64 encoding to evade detection. A memory-resident implant disguised as a native ISE component is a marker of an advanced, well-resourced actor rather than opportunistic scanning.

Lifecycle timeline

2024-10-10: MITRE CVE-2025-20337 reserved
2025-06-25: Cisco PSIRT advisory published (initially covering CVE-2025-20281 and CVE-2025-20282)
2025-07-16: NVD entry published (CVSS 10.0, CWE-74); advisory revised to add CVE-2025-20337
2025-07-16: Tenable Nessus plugin 242174 released
2025-07-24: Active exploitation confirmed in Cisco's advisory update ("Cisco PSIRT became aware of attempted exploitation of CVE-2025-20281 and CVE-2025-20337 in the wild")
2025-07-28: CISA KEV added
2025-07-29: Rapid7 InsightVM detection added
2025-08-18: CISA KEV remediation deadline

Real-world outcome

The original analyst comment, written on disclosure day, recorded the honest state of knowledge at that moment: no public proof-of-concept, no reports of active exploitation, not on CISA KEV. Every one of those statements was overtaken within two weeks. Cisco updated its advisory on July 24 to acknowledge attempted exploitation in the wild, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on July 28.

The larger reversal came months later. Amazon disclosed that a sophisticated actor had been exploiting CVE-2025-20337 as a true zero-day, before public disclosure and before patches existed, and had chained it with a Citrix NetScaler zero-day to gain persistent pre-authentication access. Independent reporting corroborated the campaign and the custom-webshell tradecraft. CISA's KEV record still lists knownRansomwareCampaignUse as Unknown, and no primary source has named specific victim organizations, so this was targeted espionage-style activity rather than mass ransomware. The gap between the disclosure-day snapshot and the eventual record is the story: a maximum-severity, unauthenticated root RCE in a foundational access-control appliance was not merely a candidate for exploitation, it had already been exploited before anyone outside the attacker knew the bug existed.

Lessons

The lesson is not "patch faster," though the incomplete first patch is its own cautionary note. Defenders who applied Cisco's June hot patches for CVE-2025-20281 and considered the matter closed were still exposed to CVE-2025-20337, because the fix did not cover the shared endpoint. Verify that a vendor patch actually closes the weakness it claims to, especially when a follow-on CVE lands in the same code path within weeks.

Three concrete moves follow:

Treat "not yet on KEV" as absence of public evidence, not absence of exploitation. For an unauthenticated CVSS 10.0 RCE on an exposed appliance, the correct default is to assume exploitation is possible on day zero and to prioritize by exposure and severity rather than by KEV status. Here, the KEV listing trailed real-world use by an unknown margin, and honeypot data later showed exploitation predated disclosure entirely.
Reduce the reachable attack surface of management appliances. ISE administrative and API interfaces belong on a restricted management network, not exposed to broad or internet-facing access. Network segmentation would not have fixed the bug, but it narrows who can reach a root-level unauthenticated endpoint.
Watch for memory-resident tradecraft on compromised appliances. The IdentityAuditAction implant lived in Tomcat's memory and mimicked a legitimate ISE component; disk-based scanning would miss it. Post-incident review of an exposed ISE node should include running-process and in-memory inspection, not just file integrity checks.

References

More Cisco CVEs all →

History

Jul 16, 2025 Disclosed CVE record published
Jul 16, 2025 Published in the daily brief critical section
Jul 17, 2025 Published in the daily brief critical section
Jul 18, 2025 Published in the daily brief critical section
Jul 28, 2025 Published in the daily brief kev section
Jul 29, 2025 Published in the daily brief kev section
Jul 30, 2025 Published in the daily brief kev section
Jul 31, 2025 Published in the daily brief kev section
Aug 1, 2025 Published in the daily brief kev section
Aug 4, 2025 Published in the daily brief critical section
Aug 4, 2025 Published in the daily brief kev section
Aug 5, 2025 Published in the daily brief kev section
Aug 6, 2025 Published in the daily brief kev section
Aug 7, 2025 Published in the daily brief kev section
Aug 8, 2025 Published in the daily brief kev section
Aug 10, 2025 Published in the daily brief critical section
Aug 10, 2025 Published in the daily brief kev section
Aug 11, 2025 Published in the daily brief kev section
Aug 12, 2025 Published in the daily brief kev section
Aug 13, 2025 Published in the daily brief kev section
Aug 14, 2025 Published in the daily brief kev section
Aug 15, 2025 Published in the daily brief kev section
Aug 17, 2025 Published in the daily brief critical section
Jul 16, 2026 Look Back published
Aug 29, 2026 Analyst report written

Sources

cisco-sa-ise-unauth-rce-ZAd2GnJ6