Cisco-CVE-2025-20281-illdeed

CVE-2025-20281 — Cisco ISE ERS API 미인증 RCE 익스플로잇 이 저장소는 CVE-2025-20281 에 대한 Python 3 개념 증명 익스플로잇입니다. 이는 Cisco Identity Services Engine ISE의 심각한 취약점으로, ERS API를 통해 루트 권한으로 미인증 원격 코드 실행RCE을 가능하게 합니다. 🩻 취약점 개요 Cisco ISE ERS /ers/sdk 엔드포인트는 사용자 생성 요청을 처리할 때 인증을 검증하지 않습니다. InternalUser 객체의 name 매개변수에 ...

CVE-2025-20281-Cisco

CVE-2025-20281 - Cisco ISE RCE 취약점 점검기 이 스크립트는 Cisco Identity Services Engine ISE 및 ISE-PIC에서 CVE-2025-20281 취약점이 존재하는지 확인합니다. 이 취약점은 특정 API에서 입력 검증 부족으로 인해 인증되지 않은 원격 코드 실행 RCE을 루트 권한으로 허용합니다. 이 도구는 공인된 보안 테스트 및 교육 목적으로만 사용해야 합니다. 소유하지 않았거나 테스트 권한이 없는 시스템에 사용하지 마십시오. 취약점 정보 CVE-2025-20281 은 인증되지...

CVE-2025-20281-2-Cisco-ISE-RCE

CVE-2025-20281-2-Cisco-ISE-RCE Cisco ISE API에 대한 인증되지 않은 CVE-2025-20281 RCE Python PoC CVE-2025-20281 인증되지 않은 PoC Cisco ISE의 ERS API에서 인증되지 않은 RCECVE-2025-20281를 InternalUser 리소스에 임의의 셸 명령을 주입하여 악용하는 최소한의 Python 개념 증명입니다. 경고: 소유하거나 명시적 테스트 권한이 있는 시스템에서만 실행하세요. 이 도구의 오용은 불법입니다. 기능 인증 불필요 두 가지 모드 지...

Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...

Cisco ISE - Remote Code Execution

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 개념 증명 Writeup: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ Python 스크립트는 인증 없이 /admin/files-upload/에서 사용 가능한 업로드 기능을 악용합니다. 스크립트는 로컬에 bin 폴더와 isehourlycron.sh라는 파일을 생성하고, Cisco ISE 설치 /opt/CSMS/bin 폴더에 위치의 원본 콘텐츠로 채웁니다파일은 base64로...

CVE-2026-20180

Cisco ISE RCE: 고급 익스플로잇 및 대응 분석 📋 목차 1. 요약 2. 공격 표면 분석 3. 익스플로잇 벡터 4. 고급 회피 기법 5. Zero Trust 아키텍처에 대한 시스템적 영향 6. 대응 전략 7. 포렌식 조사 8. 참고 자료 🎯 요약 Cisco Identity Services Engine ISE 의 원격 코드 실행RCE 취약점은 기업 경계 보안의 중대한 분기점을 나타냅니다. 최정예 보안 연구원에게 ISE는 단순한 인증 구성 요소가 아닙니다. 전체 네트워크 인프라에 대한 접근을 제어하는 마스터 키 입니다...

Blackash-CVE-2025-20343

🔒 CVE-2025-20343: Cisco ISE RADIUS 억제 DoS 취약점 🌐 ⚠️ 개요 🚨 Cisco Identity Services Engine ISE의 높은 심각도 서비스 거부DoS 결함! 💥 인증되지 않은 원격 공격자 가 조작된 RADIUS 패킷으로 장치를 충돌 시킬 수 있음. 📅 공개일 : 2025년 11월 5일 ✅ 아직 야생에서의 악용 사례 없음 🛠️ 작동 방식 🔄 "반복 실패한 클라이언트의 RADIUS 요청 거부" 설정의 논리 오류. 🕵️‍♂️ 공격자는 거부된 MAC 주소 를 대상으로 조작된 RADIUS...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multiauth-bypass-sgD2HbL4)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device. CVE-2026-76446 - A...

Cisco Identity Services Engine (cisco-sa-ise-multiauth-bypass-sgD2HbL4)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. CVE-2026-76444 - A...

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks

A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week. The trouble keeps showing up inside things people already trust: code that takes a bad turn, old payloads coming back, exposed systems, weak checks, fake fixes, and attack paths that look almost...

Cisco Identity Services Engine (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-sql-inj-3QTKR947)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation o...

Cisco Identity Services Engine (cisco-sa-ise-RADIUS-dos-wR3hYPMw)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the RADIUS feature of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is d...

Cisco Identity Services Engine (cisco-sa-ise-rce-se7bYU57)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must...

Cisco Identity Services Engine (cisco-sa-ise-rce-se7bYU57)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-mult-vul-ymSsTLCc)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. CVE-2026-20284 - A vulnerability in the SXP REST API of Cisco ISE could all...

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine ISE that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 CVSS score: 10.0, could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability i...

CVE-2026-76450

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...