https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281 CVE-2025-20281: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CVE-2025-20337: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. Added to CISA KEV on 2025-07-28. en Mon, 28 Jul 2025 00:00:00 GMT https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281 https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281#2025-07-28-deda5fab Mon, 28 Jul 2025 00:00:00 GMT critical <p>Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337): CISA added CVE-2025-20281 to the KEV catalog (due 2025-08-18).</p> https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281 https://pwn.watch/i/cisco-identity-services-engine-cve-2025-20281#2025-07-28-a4ea0cd5 Mon, 28 Jul 2025 00:00:00 GMT critical <p>Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337): CISA added CVE-2025-20337 to the KEV catalog (due 2025-08-18).</p>