Report feedback

An unauthenticated remote attacker can execute code as root on the operating system of the affected device by sending a specially crafted API request, due to insufficient validation of user input in the API of Cisco ISE and Cisco ISE-PIC [1].

The vulnerability is present in products:

• Cisco Identity Services Engine; >=3.3, <3.3 Patch 6; >=3.4, <3.4 Patch 2;
• Cisco Identity Services Engine Passive Identity Connector; >=3.3, <3.3 Patch 6; >=3.4, <3.4 Patch 2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2025-20281 at cve.org, NVD
• CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 25. 6. 2025.

An unauthenticated remote attacker can upload arbitrary files to protected locations of the affected device's system and execute code as root, due to insufficient checks in the internal API of Cisco ISE and Cisco ISE-PIC [1].

The vulnerability is present in products:

• Cisco Identity Services Engine; >=3.4, <3.4 Patch 2;
• Cisco Identity Services Engine Passive Identity Connector; >=3.4, <3.4 Patch 2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2025-20282 at cve.org, NVD
• CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 25. 6. 2025.

An unauthenticated remote attacker can perform a DoS attack or potentially execute code due to incorrect memory buffer allocation when processing PDF files in ClamAV [4][7]. This vulnerability affects only configurations where the MaxFileSize limit is set to a value ≥ 1024 MB and, at the same time, the MaxScanSize limit is set to a value ≥ 1025 MB [4].

The vulnerability is present in product:

• ClamAV; >=1.0.0, <1.0.9; >=1.2.0, <=1.2.3; >=1.3.0, <=1.3.2; >=1.4.0, <=1.4.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2025-20260 at cve.org, NVD
• CWE-122: Heap-based Buffer Overflow at cwe.mitre.org

The vulnerability was publicly disclosed 18. 6. 2025.

An unauthenticated remote attacker can perform a DoS attack on the Cisco AnyConnect service by sending crafted HTTPS requests, due to a flaw in the Cisco AnyConnect VPN server component on Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices. Only devices with the AnyConnect service enabled and client certificate authentication activated at the same time are vulnerable. The list of specific vulnerable devices and further information can be found at [6].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

More information:

• CVE-2025-20271 at cve.org, NVD
• CWE-457: Use of Uninitialized Variable at cwe.mitre.org

The vulnerability was publicly disclosed 18. 6. 2025.

An authenticated remote attacker can bypass certain authorization mechanisms in the Cisco ISE web management interface and modify specific system settings, which may, among other things, lead to a system restart. The vulnerability affects only deployments with active SAML SSO integration via an external IdP [2].

The vulnerability is present in product:

• Cisco Identity Services Engine; <=3.1; >=3.1, <=3.1P10; >=3.2, <3.2P8; >=3.3, <3.3P5; >=3.4, <3.4P2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

More information:

• CVE-2025-20264 at cve.org, NVD
• CWE-285: Improper Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 25. 6. 2025.

An unauthenticated remote attacker can obtain potentially sensitive information without authorization or perform a DoS attack due to an out-of-bounds read of a memory buffer when processing a specially crafted UDF file in ClamAV [4][5]. The vulnerability also affects Cisco Secure Endpoint Connector (Linux, macOS, Windows) and Secure Endpoint Private Cloud; information on the specific vulnerable versions can be found at [5].

The vulnerability is present in product:

• ClamAV; >=1.2.0, <1.4.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

More information:

• CVE-2025-20234 at cve.org, NVD
• CWE-125: Out-of-bounds Read at cwe.mitre.org

The vulnerability was publicly disclosed 18. 6. 2025.