# CVE-2025-20281: Cisco Identity Services Engine Injection Vulnerability

- Exploited (CISA KEV): yes, added 2025-07-28
- Published: 2025-06-25
- CVSS: 10 CRITICAL (v3.1)
- EPSS: 97.6% (100th percentile)
- CWE: CWE-74

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-08-11 | 47 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-08-15 | 51 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-08-11 · new · rule 136f67e2b6a84f15ab9a82a52e9137e1 · default Block
  > Cisco Identity Services Engine - Remote Code Execution - CVE:CVE-2025-20281. Previous action: Log. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-08-11-waf-release/

### F5

- 2025-08-15 · new · rule 200103648
  > Added: signature 200103648 "Cisco ISE ERS API Command Execution" (Command Execution, risk High), systems: Cisco. References: CVE-2025-20281.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-08-24 · updated · rule 200103648
  > Updated: signature 200103648 "Cisco ISE ERS API Command Execution" (Command Execution, risk High), systems: Cisco. References: CVE-2025-20281.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2025-20281, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2025-20281, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-20281 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-20281