id: CVE-2025-20337

info:
  name: "Cisco ISE - Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote
    attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require
    any valid credentials to exploit this vulnerability.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-20337&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=cisco&match=exact
  classification:
    cve-id: CVE-2025-20337
  metadata:
    verified: false
  tags: cve,cve2025,kev,cisco,ise,rce
http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/login.jsp"

    extractors:
      - type: regex
        name: timestamp
        part: body
        regex:
          - "\\?_isever=(\\d{10})"
        group: 1
        internal: true

      - type: dsl
        name: date
        dsl:
          - "date_time('%D-%M-%Y', timestamp)" 

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "Identity Services Engine"

      - type: dsl
        name: pre-july-16-2025
        dsl:
          - compare_versions(timestamp, '< 1752710400')